splunk - create chart with values function - charts

Background: Soon after my performance test, the response time details of the business transactions will be fed into splunk, from where I need to generate trend graph for couple of transactions for certain period of time.
Now I am able to group the response time data for these transactions but in visualization, not able to generate the chart.
Refer:SS01.jpg for more details.
query used: index=xyz source=abc (Period!=Period) Transaction_Name=Search OR Address_Book OR Policy | chart values(Average) as Average by Transaction_Name
I want the chart to appear in either format A or B as it appears on SS02.jpg.
Please help me on this.
Thanks.

You have very low values (i.e. 0.046, 0.099, etc) in the query output and very high value in the chart Y axis (100), in order to get the desired picture just reduce the maximum value for the vertical axis like:
To make the changes permanent you can amend charting.secondaryAxis.maximumNumber parameter value like it described in Controlling chart (y axis) range
Personally I prefer BM.Sense output for performance test results analysis.

Related

Foundry-workshop : add average value on a chart displaying parameter evolution

I'm looking for a way to display a line showing the average value of a parameter in a chart dedicated to this parameter's evolution.
I have a dataset, let's take as an example the following structure :
Product | Month | Price
P1 2021-01 13.00
P1 2021-02 13.50
P1 2021-03 15.00
P1 2021-04 14.50
P2 2021-01 3.00
P2 2021-02 3.50
P2 2021-03 5.00
P2 2021-04 4.50
In a chart, I display de price's evolution for each selected product (multi select filter upstream) and I would like to add, also for each product, a line showing the average for the displayed period.
I tried so far 2 different approaches:
Use multiple series and add one dedicated to this average. But I did not manage to calculate this average. Actually, to display the initial chart, the evolution of my property, it looks like I must use an aggregation function (each layer type requires to define series where the first parameter to define is an aggregation function)
Create a summary dataset, with aggregates values for each product, and the latest calculation date. It looks like this:
Product | Latest Month | Avg Price | Max Price | Min Price
P1 2021-04 14.00 15.00 13.00
P2 2021-04 4.0 5.00 3.00
But I'm not able to overlay these values, as there is no time series to define the same X-axis.
I considered a 3rd solution, but looks dirty to me: to add the aggregate values in the first dataset. Each row would contain avg/max/min values for the period of time so that I can display these values the same way as any other property.
Finally, writing this post made me wonder if I well understood how this tool works, as I feel that what I implemented should have led to display the average values I'm looking for, but it's the only way I found to display a "simple" property's evolution.
Thanks in advance for your help.
There are a few considerations at play here with regards to building your charts that lead to different approaches when it comes to deciding how to represent your data.
One point up front about charting in Workshop is, as you've observed, the chart expects you to aggregate the granular per-object data to create each data point of your visualization. If you want to instead draw some feature of the chart (a dot or bar) per object, then you'll need to select an appropriately narrow bucket size. In this case, if you have one object per product per month, then choosing a granularity of monthly or less should result in having one data point per object.
As for options related to deriving the average, let's look at three approaches:
Temporal Metrics Schema
Creating an ontology with a primary object (i.e. the "Product") and then a linked object type for storing values of metrics about that object (i.e. the "Product Metrics") can be a flexible approach that works well with Workshop and Quiver charting expectations.
Consider a modification of your original granular schema like this:
Product | Timestamp | Value | Metric Type
P1 2021-01 13.00 Monthly Price
P1 2021-02 13.50 Monthly Price
P1 2021-03 15.00 Monthly Price
P1 2021-04 14.50 Monthly Price
P2 2021-01 3.00 Monthly Price
P2 2021-02 3.50 Monthly Price
P2 2021-03 5.00 Monthly Price
P2 2021-04 4.50 Monthly Price
P1 2021-03 14.00 Quarterly Average
P2 2021-03 4.00 Quarterly Average
...
This schema is quite flexible and robust; you can easily add new metrics later, or even use a tool like Taurus to let users define their own rules to generate metrics that fit into this schema. It has the advantage of storing the metric type as data itself, which means that in your Workshop app, for example, you can let the user choose, using a Filter List widget, which metrics to display on a chart.
This pattern also ensures consistency of what the date "means" when presented to the user. Having, for example, a quarterly average pre-calculated means that every user will get the same information from reviewing the chart, regardless of what time period they filter to, whereas a dynamic average based on the user's selection could lead two different users to quite different conclusions based on how they chose to filter the data.
And finally, for this pattern, it becomes quite easy to show the chart itself, since you simply choose to plot the filtered object set of metrics and choose the "Metric Type" as the series property, bucket by a small granularity (say "Day") and have the chart interpolate any gaps. This means that even aperiodic metrics along with metrics recorded at different periods can all render on the same chart.
This pattern is somewhat formalized with the nascent Time-Dependent Property feature of the Foundry Ontology. If the Time-Dependent Property feature is available on your Foundry instance, you can read more about it in the Ontology product documentation in the "How to create a Time-Dependent Property" section.
Dynamic Charts with Functions
Let's say you don't want to precompute the metrics for whatever reason, and instead want your chart to exactly render a line based on the average price values that are in the object set. One approach to accomplish this is to use a Function-backed Chart and a simple Typescript function that takes in as a parameter to object set of price information and returns a 2DimensionAggregation type that represents two data points: the first and last timestamp of the period represented by the input object set each paired with the average value calculated across the price values or a 3DimensionalAggregation since you perhaps want these two data points for each product category.
You can find clear steps in the Workshop and Functions product documentation for producing Function-backed Charts as well as examples of various Typescript Function implementations in the Foundry Training and Resources project on your Foundry instance.
Dynamic Charts using Quiver
The Workshop XY Chart is still under active development and a number of features that might be useful are not yet available. In some circumstances creating the chart in Quiver and embedding it in your Workshop app with the Quiver Canvas widget can give you flexibility to build charts with "derived" values that you cannot currently accomplish directly with the Workshop chart.
I'm adding this for completeness; I don't actually think it'd be the best solution in this specific case. The power in this pattern comes from taking an object-backed bar or line chart in Quiver and using the "Convert to Timeseries" feature to unlock Quiver's timeseries plotting and transformation capabilities. You can check out the Quiver documentation for more guidance on how to create object-derived timeseries and how to turn a Quiver canvas into an Object Template to be embedded elsewhere.
As far as I understand, according to #Logan's answer, the documentation, my tests, the solution is based on a key feature I did not really understood before: a chart always displays an aggregate value of a property.
It's something I noticed and mentioned in my question, and I just understood how this aggregation is performed: there is no parameter to define an interval of any kind, but when your X-axis is a date, you need to select a bucket, and that actually is the aggregation interval. If your date is daily basis and you decide to display values at weekly level, the aggregation is based on 7 days.
Thus, the solution I found was just to add exactly the same layer than my monthly values, I just changed the bucket in the second one to display yearly values (it was actually what I was looking for, my sample data were just one quarter because I did not see it would have had an impact).
But if I needed to visualize a quarterly average (#Logan's answer made me asked), how should I proceed?
I assume I would have several approaches: the ones described by #Logan, even if I'm still doubtful about the first one. At least, I looks like function-backed chart would work, but I do not know typescript at all to implement such functions. Otherwise, preparing data in the same dataset, or in an another one, designed to be displayed with the same scale, might work as well.
How to deal with a rolling average?
Well, I'm not sure it's possible, the only solution I see is function-backed chart but, one more time, I do not know typescript... I would probably use Slate instead, where I'm sure I'll be able to implement it.
Of course, any comment is welcome here, as I am still in a discovering phase of this tool.

Displaying change in moving average on map

I am trying to show the change in moving average by county on a map.
Currently, I have the calculated field for this:
IF ISNULL(LOOKUP(SUM([Covid Count]),-14)) THEN NULL ELSE
WINDOW_AVG(SUM([Covid Count]), -7, 0)-WINDOW_AVG(SUM([Covid Count]), -14, -7)
END
This works in creating a line graph where I filter the dates to only include 15 consecutive dates. This results in one point with the correct change in average.
I would like this to number to be plotted on a map but it says there are just null values.
The formula is only one part of defining a table calculation (a class of calculations performed client side tableau taking the aggregate query results returned from the data source)
Equally critical are the dimensions in play on the view to determine the level of detail of the query, and the instructions you provide to tell Tableau how to slice up or layout the query results before applying the table calc formula. This critical step is known as setting the “partitioning and addressing” for the table calc, sometimes also as setting the “compute using”. Read about it in the online help for table calcs. You can experiment with using the Edit Table Calc dialog by clicking on the corresponding pill.
In short, you probably have to a dimension, such as your Date field to some shelf - likely the detail shelf, and the set the partitioning and addressing, probably to partition by county and address by state.
If you have more than a couple of weeks of data, then you’ll get multiple marks per county. You may need to decide how to handle that on your map.

y axis limit - appears to alter the data that is analysed

I have a bunch of data where the hours taken to process an item ranges from 3-3000 hours. most of the data is <1000 hours
I am creating a boxplot of that data. I have an large number of outliers within the data that I don't need to display, but I do need to analyse.
I have tried to use both 'scale_y_continuous(limits=c(0,1000))' and 'ylim(0,1000)' that appears to change the data that is used to create the boxplot, I altered the limits to '20' to test this theory and I get a complete plot, which can only be because the method i'm using to limit the axis also limits the range of data analysed.
I'd like to limit the y axis but not limit the range of data that is used in the analysis, what function do I use to accomplish that?
many thanks
it appears that it's 'coord_cartesian(ylim = c(nnn,nnn))+' that I needed to use.

Is it possible to access forecast results in calculated measure?

I am trying to find time series outlier using Tableau forecast. I need to compare the actual value with the 95% confidence level in forecast results to determine if it is an outlier.
I understand I can view the forecast results on the chart. But I want to use the forecast results in calculated measure. Is there any way to do it? I cannot find any Tableau functions to retrieve the forecast results.
Xuefei. Doesn't look like there is a way currently, at least going by their help page - https://help.tableau.com/v2019.1/pro/desktop/en-us/forecast_options.htm. If you haven't already considered this - integration with R is easy and that way you could just model it in R (accounting for additive/multiplicative, trend/cyclicity/seasonality) and access the forecast values from R. Integration with Python is also supposed to be easy, although I haven't tried it myself.
Example of code in Tableau to incorporate R code for linear regression (this is the formula for the calc field in Tableau)
SCRIPT_REAL("
fv=log(.arg1)
fpri=.arg2
fit=lm(fv~fpri)
exp(fit$fitted)",SUM([Impressions]),SUM([CPM]))

Adding average lines to Tableau bar chart

I have a Tableau bar chart which plots a number of measures for one particular row at a time in my data set (using a Quick Filter).
I was wondering if there was an easy way to add a reference line for each measure's average value across the entire data set.
You may have to bring in more data and use an alternative filtering method to 'quick filter' (like using a conditional expression in a calculated field). Such as:
if (condition of quickfilter) then
data
else
null
end
this way you can view only limited rows of data in your viz, while also bringing in the rest of the data for the average calculation.