Dashboards & Visualizations

How can i get the graph for 150 records ?

rakesh_498115
Motivator

Hi..

My search query returns me a set of 150 records and when i try to plot a graph for these 150 records , I hardly see the values for 40 records remaning were not actually plotted or shown in graph..how can i make this enable so that to see all the values coming in the graph....

Thanks in advance.

Tags (2)
0 Karma
1 Solution

jonuwz
Influencer

Ok first up you need to convert Day into a date that splunk'll understand.

| inputlookup StatsData.csv | eval _time=strptime(Day,"%d-%B-%y")

Next up, you want to plot it.

So we can add

| timechart span=1d avg(AvgBest95) as AvgBest95 avg(AvgWorst5) as AvgWorst5

You can then drill into the timeranges.

Even though we're using avg(AvgBest95) - because you have 1 pont a day (or i'm assuming you do) the average will be the same as the single value for the day anyway.

This works on splunk 4.3.x

I've you're running a previous version, you may have to resort to the xyseries method outlined here

another tip - if your dates on the x-axis look messed up even after converting to a format splunk can process adding this, fixes it a lot of the time

| makecontinuous _time

View solution in original post

0 Karma

jonuwz
Influencer

Ok first up you need to convert Day into a date that splunk'll understand.

| inputlookup StatsData.csv | eval _time=strptime(Day,"%d-%B-%y")

Next up, you want to plot it.

So we can add

| timechart span=1d avg(AvgBest95) as AvgBest95 avg(AvgWorst5) as AvgWorst5

You can then drill into the timeranges.

Even though we're using avg(AvgBest95) - because you have 1 pont a day (or i'm assuming you do) the average will be the same as the single value for the day anyway.

This works on splunk 4.3.x

I've you're running a previous version, you may have to resort to the xyseries method outlined here

another tip - if your dates on the x-axis look messed up even after converting to a format splunk can process adding this, fixes it a lot of the time

| makecontinuous _time

0 Karma

rakesh_498115
Motivator

Even now i cant see the dates...i have used like this

| inputlookup StatsData.csv | eval _time=strptime(Day,"%d-%B-%y") | fields _time,AvgBest95,Mean95,UCL95,LCL95 | makecontinous _time

Nothing Was getting displayed on X-axis .Can we have any other option for this.i am using splunk 4.3.x only...

0 Karma

rakesh_498115
Motivator

and the Day field on X-Axis ..is displaying as "..." instead of "1-JULY-12" , even that was awkard to see ..can we have a better look for this Day..ie vertically on Y-AXIS..is tat possible ? and how can we the get the graph fot all the data ??

0 Karma

rakesh_498115
Motivator

Actually i have stored my search results in a csv file..and

these results like this in order..

mydata ::

Day,AvgBest95,AvgWorst5
1-JULY-12 3.00 5.00
....

....

ie. last 3 months data..

i have used the query to retrieve these values like this..

|inputlookup StatsData.csv | fields Day,AvgBest95,AvgWorst5

i have created the line chart graph taking Day on X-Axis and AvgBest95 ,AvgWorst5 on Y-Axis..

The Graph was fine..but it was jus showing me for 1 and a half month data only..but in search results i can see all the 3 months data..i dnt knw wats happening ?

0 Karma

lguinn2
Legend

Hi Rakesh - we will need more information in order to help. Can you show us a sample of a couple of the 150 records (sanitized of course) - and your search query?

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...