Dashboards & Visualizations

How can i get the graph for 150 records ?

rakesh_498115
Motivator

Hi..

My search query returns me a set of 150 records and when i try to plot a graph for these 150 records , I hardly see the values for 40 records remaning were not actually plotted or shown in graph..how can i make this enable so that to see all the values coming in the graph....

Thanks in advance.

Tags (2)
0 Karma
1 Solution

jonuwz
Influencer

Ok first up you need to convert Day into a date that splunk'll understand.

| inputlookup StatsData.csv | eval _time=strptime(Day,"%d-%B-%y")

Next up, you want to plot it.

So we can add

| timechart span=1d avg(AvgBest95) as AvgBest95 avg(AvgWorst5) as AvgWorst5

You can then drill into the timeranges.

Even though we're using avg(AvgBest95) - because you have 1 pont a day (or i'm assuming you do) the average will be the same as the single value for the day anyway.

This works on splunk 4.3.x

I've you're running a previous version, you may have to resort to the xyseries method outlined here

another tip - if your dates on the x-axis look messed up even after converting to a format splunk can process adding this, fixes it a lot of the time

| makecontinuous _time

View solution in original post

0 Karma

jonuwz
Influencer

Ok first up you need to convert Day into a date that splunk'll understand.

| inputlookup StatsData.csv | eval _time=strptime(Day,"%d-%B-%y")

Next up, you want to plot it.

So we can add

| timechart span=1d avg(AvgBest95) as AvgBest95 avg(AvgWorst5) as AvgWorst5

You can then drill into the timeranges.

Even though we're using avg(AvgBest95) - because you have 1 pont a day (or i'm assuming you do) the average will be the same as the single value for the day anyway.

This works on splunk 4.3.x

I've you're running a previous version, you may have to resort to the xyseries method outlined here

another tip - if your dates on the x-axis look messed up even after converting to a format splunk can process adding this, fixes it a lot of the time

| makecontinuous _time

0 Karma

rakesh_498115
Motivator

Even now i cant see the dates...i have used like this

| inputlookup StatsData.csv | eval _time=strptime(Day,"%d-%B-%y") | fields _time,AvgBest95,Mean95,UCL95,LCL95 | makecontinous _time

Nothing Was getting displayed on X-axis .Can we have any other option for this.i am using splunk 4.3.x only...

0 Karma

rakesh_498115
Motivator

and the Day field on X-Axis ..is displaying as "..." instead of "1-JULY-12" , even that was awkard to see ..can we have a better look for this Day..ie vertically on Y-AXIS..is tat possible ? and how can we the get the graph fot all the data ??

0 Karma

rakesh_498115
Motivator

Actually i have stored my search results in a csv file..and

these results like this in order..

mydata ::

Day,AvgBest95,AvgWorst5
1-JULY-12 3.00 5.00
....

....

ie. last 3 months data..

i have used the query to retrieve these values like this..

|inputlookup StatsData.csv | fields Day,AvgBest95,AvgWorst5

i have created the line chart graph taking Day on X-Axis and AvgBest95 ,AvgWorst5 on Y-Axis..

The Graph was fine..but it was jus showing me for 1 and a half month data only..but in search results i can see all the 3 months data..i dnt knw wats happening ?

0 Karma

lguinn2
Legend

Hi Rakesh - we will need more information in order to help. Can you show us a sample of a couple of the 150 records (sanitized of course) - and your search query?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...