Splunk Search

How to put multiple charts into a single chart

codedtech
Path Finder

I'm trying to get a visualization together that will mark growth at 30, 60, and 90 days into a single graph with different markers for each point.

|myquery
| timechart span=1d avg(PHYSICAL_USED) as used, avg(PHYSICAL_CAPACITY) as Capacity 
| predict used as growth algorithm=LLP5 lower40=low upper40=high future_timespan=30
| predict Capacity as Capacity_THOLD upper40=high lower40=low future_timespan=30
| predict used as growth algorithm=LLP5 lower40=low upper40=high future_timespan=60
| predict Capacity as Capacity_THOLD upper40=high lower40=low future_timespan=60
| predict used as growth algorithm=LLP5 lower40=low upper40=high future_timespan=90
| predict Capacity as Capacity_THOLD upper40=high lower40=low future_timespan=90

Currently I can only 1 large chart with no data points or 3 charts.

0 Karma

Sukisen1981
Champion

hi @codedtech
I can see where you are going with this.You can not have growth as the predicted field value for all 3 future time span scenarios, the last one will over write the first 2, same goes for capacity. However if you can manage with growth,growth1,growth2 for the 30...60 and 90 day scenarios (kinda same for capacity), there is a way.
Try this (did only for the growth prediction, but you will get the drift), predict allows comma separation for multiple predicts in one pipe.

 |myquery
 | timechart span=1d avg(PHYSICAL_USED) as used, avg(PHYSICAL_CAPACITY) as Capacity 
 | predict used as growth algorithm=LLP5 lower40=low upper40=high future_timespan=30, used as growth1 algorithm=LLP5 lower40=low upper40=high future_timespan=60,used as growth2 algorithm=LLP5 lower40=low upper40=high future_timespan=90

in theory you can add capacity,capacity1 and capacity2 to the same predict pipe by adding commas.
How the graph looks like is another question 🙂
Maybe have 2 graphs one each for growth and capacity, each having the 30,60 and 90 day predictions for growth and capacity respectively?

0 Karma

Sukisen1981
Champion

hi @codedtech
Please let us know if your issue has been resolved and accept the answer if it significantly helped your resolution. Do not forget to add additional resolution details for the benefit of other form members.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...