Splunk Search

How can I get an Ideal BurnDown line on a chart in Splunk?

kalyangoutham
New Member

I have a requirement to add an ideal Burndown line on a chart that shows a constant decrease in value of Y across a specified time interval.

To be more precise:
I want to get a BurnDown line in the period (Jan 1st to Jan 10th) and the initial StoryPoints (Y value) on Jan1st is 140.
The burndown points will be 140/10=14

Then the Timechart to be generated should be
Jan 1st -> 140
Jan 2nd -> 126 (140-14)
Jan 3rd->112 (140-(14*2))
Jan 4th->98 (140-14*3)
Jan 5th->84 (140-14*4).
.
.
.
Jan10th->0

How can we achieve this is Splunk? I will be glad to receive help on what functions we need to use or the combination of functions in Splunk. Thanks in advance.

0 Karma

sundareshr
Legend

Try this

| gentimes start=1/1/16 end=1/10/16 | eventstats first(starttime) as start last(starttime) as end | eval days=(end-start)/(60*60*24) | streamstats count | eval stories=round(140/count, 0) | stats values(stories) as stories by starttime | eval starttime=strftime(starttime, "%x %X")

kalyangoutham
New Member

Thanks Sundaresh. Able to get a straight line burndown chart with a minor modification of the above query. Thanks for sharing the logic on how this is to be calculated with the group of Splunk commands.

In place of eval stories=round(140/count, 0)
in the above command, i have used
eval stories=round(140-14*count, 0)

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...