Dashboards & Visualizations

dynamic span

wcleong
New Member

hi, I have a area chart as below search command

index=index_rv TAG="*" CELL_NAME=* TAG!=TAG CELL_NAME!=CELL_NAME |  eval Diff_Percentage = max(Metal_I_diff)  | eval Current = Metal_I_1 * 1 |  chart min(Diff_Percentage),max(Diff_Percentage) by Current span=0.01

however, my data range for x axis might be varied, and I would like to have the spanning to be max(Current)/1000 so that I can span it to 1000 plot only, can I know how to do it? I tried below but it is not working

index=index_rv TAG="*" CELL_NAME=* TAG!=TAG CELL_NAME!=CELL_NAME |  eval Diff_Percentage = max(Metal_I_diff)  | eval Current = Metal_I_1 * 1 |  chart min(Diff_Percentage),max(Diff_Percentage) by Current span=eval(max (Current)/10000)
Tags (2)
0 Karma

wcleong
New Member

The problem is when using bins, it will tend to not bucketise the 0 value, and cause the graph to be non linear on the x-axis.. I need to see the overall graph shape.

0 Karma

dwaddle
SplunkTrust
SplunkTrust

You might try instead of setting a specific span= to use bins= in order to tell the chart command that you want it to use (up to) a set number of bins, and let it figure out an appropriate size.

0 Karma

wcleong
New Member

The problem is when using bins, it will tend to not bucketise the 0 value, and cause the graph to be non linear on the x-axis.. I need to see the overall graph shape.

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...