Splunk Search

Chart set range value

markgomez00
Explorer

Hi,

I have a perfmon counter which is monitoring the SLA, most of the time it's constant in a huge number(millions), and goes in a downward trend which basically indicates that the SLA is about to be breached.

what i want to achieve in the chart/panel is set a range within 0-100, so when the SLA goes down and reached the range <100 range that's the only time it should show in the chart, from 99 down to the lowest value it would reach

my search string is

host=[hostname] index=[index]  counter="SLA violation countdown"  | timechart max(Value) by instance

so far i have tried to add the options:

<option name="charting.axisY.minimumNumber">0</option>
<option name="charting.axisY.maximumNumber">100</option>

but nothing shows up on the chart
also if you have better ideas on a better approach, it would be great 🙂
any help would be appreciated, Thanks in advance guys

Tags (3)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

For data to appear, the data's value must be within the chart's y-axis limits. If you set the y-axis to have a range of [0,100] then your data must also be [0,100] or it will be drawn "off the chart".

You could normalize your data, if you have an idea of what defines " < 100% ". Say for example anything below 123,456,789 is "abnormal" and we want a linear drop...

<your search> 
| eval sla_percent= if(count >= 123456789,101,((count / 123456789) * 100))

This establishes 123,456,789 widgets / time interval as "101% SLA". Anything above that is still 101% SLA. With the chart's y-axis fixed at [0,100] then the hard-coded 101% value will not be drawn on the chart at all. Anything less than your trigger value is ranged from 0 to 100 linearly. So if you are producing 122,000,000 widgets / time interval then that corresponds to an SLA of 98.82 -- and will appear on the chart.

Note if your chart is a bar or column chart instead of a line or area you may want to hard-code "ideal" at -1 instead of 101 -- so it's drawn "below" the lower range of the y-axis.

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

For data to appear, the data's value must be within the chart's y-axis limits. If you set the y-axis to have a range of [0,100] then your data must also be [0,100] or it will be drawn "off the chart".

You could normalize your data, if you have an idea of what defines " < 100% ". Say for example anything below 123,456,789 is "abnormal" and we want a linear drop...

<your search> 
| eval sla_percent= if(count >= 123456789,101,((count / 123456789) * 100))

This establishes 123,456,789 widgets / time interval as "101% SLA". Anything above that is still 101% SLA. With the chart's y-axis fixed at [0,100] then the hard-coded 101% value will not be drawn on the chart at all. Anything less than your trigger value is ranged from 0 to 100 linearly. So if you are producing 122,000,000 widgets / time interval then that corresponds to an SLA of 98.82 -- and will appear on the chart.

Note if your chart is a bar or column chart instead of a line or area you may want to hard-code "ideal" at -1 instead of 101 -- so it's drawn "below" the lower range of the y-axis.

markgomez00
Explorer

Thanks @dwaddle, exactly what i needed :), had to set the normal SLA > 100, anything below that is abnormal and is show in the chart

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...