Splunk Search

How to add a minimum and maximum range to a sparkline in a singlevalue chart

martinpu
Communicator

I have some single values graphs spark-lines that are supposed to return a success-rate of service calls by _time. Please see attached for example.

The spark-line indicates how the success-rate looks in past minutes as compared to now, the number is the latest rate and the trend is that compared to latest- 1 span of _time.

The trouble with this is that a drop of 25% in success-rate looks the same as a 2% drop due to the fact that the spark-line does not have a defined lower or upper boundary, boundaries are generated based on the data that is seen and cant be defined as static.

So if success-rate drops to 95 and then back to 100 again, it looks the same as if it would have dropped to 25 and back to 100% again if looking only at spark-line. I would like it to always compare vs min 0 and max 100.

I have tried these options but they are not working for this type of chart:

<option name="chartRangeMin">0</option>
<option name="chartRangeMax">100</option>

error:

Unknown option name="chartRangeMin" for node="single"

Any Ideas on how to make this happen?

Attached is an image displaying a 1% drop.This should look like a barely noticeable blip - not like an upside-down triangle.

0 Karma

jawaharas
Motivator

This works for me.

<format field="sparkline" type="sparkline">
    <option name="type">line</option>
    <option name="height">100px</option>
    <option name="chartRangeMin">0</option>
    <option name="chartRangeMax">100</option>
</format>
0 Karma

martinpu
Communicator

It does not work for single-value visualisation sparklines.

I get this error:

Node <format> is not allowed here

My current formating options:

        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="drilldown">all</option>
        <option name="height">124</option>
        <option name="numberPrecision">0.0</option>
        <option name="rangeColors">["0x555","0xdc4e41","0xf1813f","0xf8be34","0x2E8B57"]</option>
        <option name="rangeValues">[35,85,90,97]</option>
        <option name="refresh.display">progressbar</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="trendInterval">-1m</option>
        <option name="unit">%</option>
        <option name="unitPosition">before</option>
        <option name="useColors">1</option>
0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...