How To Add Custom Baseline In Splunk Dashboard
Hi Guys!!!
Today, we have come with an interesting topic which can be very useful for your data visualization.
We will discuss about is “charting.fieldDashStyles” with chart visualization which can be used to create dashed style baseline if you have any baseline in your query of the dashboard. So, let’s start.
Step: 1
First, Sign In to your Splunk instance with your username and password.
Step: 2
Now, click on “Search & Reporting” app to go inside the app.
Step: 3
We have used the below query to create a dashboard called “Dash Style demo”.
index=test_index sourcetype=cpu_info | timechart span=1h avg(CPU_usage) by Server_name | fillnull | eval baseline=50
Explanation:
Here, we are using “test_index” index and sourcetype name is “CPU_info” , where we have our sample data.
Then we have used “timechart” command with time span of 1h. Along with that we have used “avg” function to get the average cpu usage (avg(CPU_usage)) group by the field values of “Server_name” field.
Then, we have used “fillnull” command to fill the null values with “0” (zero).
Then we have used “eval” command to create a new field called “baseline” and set the value “50” to it. On this “baseline” field, we will show you the usage of “charting.fieldDashStyle”.
Step: 4
In the below image, you can see, how the dashboard is looking in “Column Chart” visualization and also you can see the “baseline” is coming as a straight line (The line in Red color). We have used chart overlay in the format option.
Now, if you want to break this straight line into small dashes, we can do that using “charting.fieldDashStyles”.
Step: 5
Now, click on the “Edit” option to edit the dashboard.
Step: 6
Now, click on the “Source” option to edit the Source Code of the Dashboard.
Step: 7
Explanation:
Here, we have used,
<option name="charting.fieldDashStyles">{"baseline":"shortDash"}</option>
“charting.fieldDashStyles” is used to change the visualization of the “baseline” field in dash style and as we have used “shortDash”, so it will be broken into short dashes.
Step: 8
Now, click on the “Save” option to save the dashboard with the changes.
Step: 9
As, you can see in the above image the baseline is now broken into small dashes [The line in Red color].
Hope you have understood the topic on : How To Add Custom Baseline In Splunk Dashboard
Happy Splunking !!!
