Splunk Search

How do you create 2 variables Y axis column chart?

nyasharashad59
Explorer

Hello, I want create a column chart with 2 y-axis variables (AP and FP). I want AP to be the number of bars on the X axis and FP to be the color of bars. For example IF AP is 0 and FP is 0 we have 4 green bars, when AP is 4 and FP is 0 we have 1 green bar. If FP changes, the color of the bars changes. If AP changes the number of bars change .alt text Find attached desired outcome. thanks in advance

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

You just need to make FP your series value, set the colors for each series, and do a stacked bar chart.

I have no idea in the world how you figure your number of bars. An AP value of 0 gets 4 bars, a value of 4 gets 0 bars? Not a clue. Just feed the chart the number of bars you want.

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Okay, you'll have to figure out whether you are looking for sum, max, avg, first, last or whatever for the AP and FUP values in any give one hour period, and adjust the stats command accordingly...

index=sandvine sourcetype=sql subscriber_name="$subscriberid$"
| bin _time span=1h
| stats sum(subscriber_ap) as SAP sum(subscriber_fup) as FUP 
| eval chartbars=round(SAP/50)
| eval chartcolor=case(FUP>=150,"orange", FUP>=100,"yellow", true(),"green")
| timechart span=1h max(chartbars) by chartcolor

Then set the chart format to stacked, so that you wont get empty slots for the other two.

You may need some fiddling after that as per this page... http://docs.splunk.com/Documentation/Splunk/6.2.4/Viz/Chartcustomization ... to make green come out green and so on, but the basics are there for you.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

You just need to make FP your series value, set the colors for each series, and do a stacked bar chart.

I have no idea in the world how you figure your number of bars. An AP value of 0 gets 4 bars, a value of 4 gets 0 bars? Not a clue. Just feed the chart the number of bars you want.

0 Karma

nyasharashad59
Explorer

alt text

0 Karma

nyasharashad59
Explorer

Hello DalJeanis

I have two variables subscriber_ap and subscriber_fup. AP being a scale of 0- 4. FUP being a colour. So lets say you got subscriber_ap on 100 (it should mark on 2 on the y-axis) and subscriber_fup is on 200 it should put the color Red. I have used the commands attached but still no joy!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...