Multi series graph split by group clause

[khourihan_splun]

I have a question regarding graphs generated by stats/chart/timechart/etc. When the output has more than a single results set, the graphing options include separating each set to its own graph. I was wondering whether it was possible to separate the results into multiple graphs using the grouping command's group clause?

Example:
I have a search that looks at the loading time of a certain element, calculating average, mean, and minimum times per country. When there is more than a single country, I can either have everything on the same graph (three lines per country), or one graph per line. Is there a way to have a graph per country, with the three relevant lines?

[sideview · Accepted solution]

You're referring there to the key called "charting.layout.splitSeries", that can be set to True or False. In the Simple XML:

<option name="charting.layout.splitSeries">True</option>

and in the advanced XML you'd have this in your HiddenChartFormatter module:

<param name="charting.layout.splitSeries">True</param>

However, how this key works is that the "split-by" values each get their own chart. So if you have "timechart count by foo", there will be one little graph for each value of "foo". Another way to look at it, is that when you view the results as a table, each column header becomes its own little chart.

So this wont work for you, because there's no way to tell the splitSeries logic that you want each triplet of stats to stay grouped together in each chart. Even after figuring out the advanced stats and xyseries to get a chartable dataset, the splitseries key would put each individual line into it's own chart.

So what I recommend, and actually the only way I know of to do this, is to use the Sideview Multiplexer module that comes in Sideview Utils. The Multiplexer is a very advanced module and it's a little mindbending.

Here is one of the working examples taken straight out of the Multiplexer documentation ( look inside Sideview Utils itself for the docs). This example takes a high-dimensional search results set and carves it up so as to "multiplex" a JSChart, and show one JSChart per sourcetype. Although here the multiplexed charts are also simple single-line charts, the technique works just as well when the charts themselves are multi-series. Note that Multiplexer is pageable via the Pager module so in this example if you end up multiplexing more than 5 sourcetypes, it puts the rest behind "page 2 3 4 5" links etc...

<module name="Search" layoutPanel="panel_row3_col1" autoRun="True">
  <param name="search">index=_internal source=*metrics.log group=per_sourcetype_thruput | bin _time span="1min" | stats sum(kb) as totalKB by series, _time | rename series as sourcetype</param>
  <param name="earliest">-60m</param>
  <param name="latest">now</param>

  <module name="JobProgressIndicator" />

  <module name="HiddenChartFormatter">
    <param name="charting.chart">line</param>
    <param name="charting.legend.placement">none</param>
    <param name="charting.axisTitleX.visibility">collapsed</param>

    <module name="PostProcess">
      <param name="search">dedup sourcetype | sort sourcetype</param>
      <module name="Pager">
        <param name="count">5</param>

        <module name="Multiplexer">
          <param name="field">sourcetype</param>

          <module name="PostProcess">
            <param name="search">search sourcetype="$sourcetype$" | timechart span="1min" max(totalKB) as totalKB</param>
            <module name="HTML">
              <param name="html"><![CDATA[
                <h2>$sourcetype$</h2>
              ]]></param>
            </module>

            <module name="JSChart">
              <param name="height">150px</param>
              <param name="width">100%</param>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</module>

You'll want to read the first few intro views carefully, and definitely study the PostProcess documentation contained in Sideview Utils (even if you feel you understand postprocess), and only then should you read the two pages of Multiplexer documentation and examples.

Also remember you can only find the Multiplexer module in the 2.X version of Sideview Utils, available free for internal use, from the Sideview website. http://sideviewapps.com/apps/sideview-utils

[khourihan_splun]

Thanks for taking the time to answer Nick. I've suggested it to the customer and he is considering it.