The Art of Splunk
Splunk. Application management, business & web analytics, security monitoring, IoT data visualiser. And modern minimalist art creation tool?
Well, Splunk does describe itself as a “data into everything” platform. Surely, with such a blanket term as “everything”, it must be possible to make something visually appealing. I wouldn’t expect any budding Bob Ross’ to be satisfied with what Splunk is capable of, but if you know any dentist clinics with bare walls, this article might be worth reading.
Where to start? Most art depicts items of beauty, whether it be natural or human made. Just like Vincent Van Gogh would have, I looked on the internet for some inspiration. After about one and a half minutes of searching, I stumbled across these things called “The Pyramids of Giza”. Apparently they’re glorified cemeteries for Egyptian rulers.
So how could I depict a pyramid ideally using one of Splunk’s limited built in visualisations? Pyramids have multiple lines originating from one point, just like a pie chart. Excellent! Now I just need the data to generate the segments. I had several options, but I chose to use a lookup table. These are easily created in the lookup editor app, found on Splunkbase (app 1724).
The size of the segments took a bit of trial and error, but 90 degrees, or a quarter of the pie should be made of pyramid, and the rest sky. 70 degrees of sunlit pyramid, 20 unlit. Having worked out the segments, I hit save and named the file “pyramid.csv”. Back to search, and I use the following SPL to generate the table:
“|inputlookup pyramid.csv |table Part, Area”
Oh dear. The segments look the right shape, but the colours look straight out of a child’s ball pit.
Unfortunately, the pie chart is one of the least configurable visualisations in Splunk’s repertoire. It’s not very obvious that you can, however if you’re comfortable with dealing with simple XML it’s quite easy to change the colours. This guide shows you the different configuration options you can choose in simple XML visualisations: https://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/ChartConfigurationReference
Once you get familiar with simple XML, it does give you a little more flexibility. For example, the ability to move multiple charts into one panel does neaten things up, but unless you are using single value charts, it stacks them vertically.
Anyway, for the colours I chose blue, yellow and a darker yellow. The pharaohs would be proud. Hex colours are required for this operation, so feel free to acquire them how you please.
The following option is used to change the colours:
Drum roll please. Hang on, that looks quite good!
Now I just need to remove those ugly labels. Hey, what are they even for?
Wow. That might actually look good. It’s just a shame you can’t gradient the individual colours.
Anyway, these minimalist pieces often come in sets of three, probably because they aren’t very interesting on their own. I’m going to make a set of three, inspired by different times of day. A quick copy and double paste of everything in <panel></panel> and you’ve easily got three copies. Now it’s time to alter the colours slightly. Here is the end result:
Here it is. “The Three Pyramids”, commission 1/1.
What I have learned from this process, is that Splunk is the ideal art creation tool. As long as you like pyramids.