Splunk Search

How can I get an Ideal BurnDown line on a chart in Splunk?

kalyangoutham
New Member

I have a requirement to add an ideal Burndown line on a chart that shows a constant decrease in value of Y across a specified time interval.

To be more precise:
I want to get a BurnDown line in the period (Jan 1st to Jan 10th) and the initial StoryPoints (Y value) on Jan1st is 140.
The burndown points will be 140/10=14

Then the Timechart to be generated should be
Jan 1st -> 140
Jan 2nd -> 126 (140-14)
Jan 3rd->112 (140-(14*2))
Jan 4th->98 (140-14*3)
Jan 5th->84 (140-14*4).
.
.
.
Jan10th->0

How can we achieve this is Splunk? I will be glad to receive help on what functions we need to use or the combination of functions in Splunk. Thanks in advance.

0 Karma

sundareshr
Legend

Try this

| gentimes start=1/1/16 end=1/10/16 | eventstats first(starttime) as start last(starttime) as end | eval days=(end-start)/(60*60*24) | streamstats count | eval stories=round(140/count, 0) | stats values(stories) as stories by starttime | eval starttime=strftime(starttime, "%x %X")

kalyangoutham
New Member

Thanks Sundaresh. Able to get a straight line burndown chart with a minor modification of the above query. Thanks for sharing the logic on how this is to be calculated with the group of Splunk commands.

In place of eval stories=round(140/count, 0)
in the above command, i have used
eval stories=round(140-14*count, 0)

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...