Dashboard chart - with 3 columns that compare col 1 to col 2 with col 3 showing the deltas.

[jrjarcher]

Is the dashboard chart UI element the right thing to use to create a query that will show 3 columns, configured as follows: column 1 shows values for result X, column 2 shows values for result Y, and column 3 shows the deltas between column 1 and column 2.

Any pointers to examples? Thanks!

[jrjarcher]

Here's an image of what I am hoping to create with a Splunk dashboard UI element:

[niketn]

@jrjarcher depending on how you want to present the data, chart will obviously be able to depict the information you are looking for. For example X, Y and X-Y.

Following are two options, 1) Using Chart Overlay where Delta becomes the overlay and (2) Stacked Chart. But there could be several others as well.

Following is the Simple XML code for run anywhere example which generates data similar to your question and creates series by data1, data2, data3... this could be any of your aggregation key or even time span.

 <dashboard>
  <label>Two series and Delta</label>
  <row>
    <panel>
      <chart>
        <search id="base">
          <query>| makeresults count=10
| fields - _time
| streamstats count as sno
| eval sno="data".sno
| eval X=random(), X=substr(X,1,3), Y=random() ,Y=substr(Y,1,3)
| eval delta=X-Y
| table sno "X" "Y" "delta"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">1</option>
        <option name="charting.axisY2.scale">log</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.overlayFields">delta</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <search base="base">
          <query/>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">log</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
  </row>
</dashboard>

[jrjarcher]

This is awesome! Thank you. I might use this as another way to represent the data in my dashboard.

However, I'm looking for something .... more simplistic. I'm sure I'm not explaining myself very well. Visually, I was hoping to show the UI element on the dashboard as follows:

feature test_1 test_2 delta
X. 1.0 2.0. +1.0
Y 8. 3. -5
Z 2.3. 2.0. -0.3

Just a simple table (I know I said chart in my original question, I'm not sure which element is "best" to use) that has the results of 2 series and the deltas between the series. In a simple table format, almost like a spreadsheet. Is there a dashboard widget that I will do this?

[niketn]

@jrjarcher if you want to share a dummy/sample screenshot or whiteboard image, you can use any image sharing site like imgur etc and then post the image using the Image Icon on Splunk Answers or Short cut key Ctrl + G. Please try and confirm as the image that you tried to post does not show up.

[jrjarcher]

Here's what I'd like the table to look like, if possible: