topic Re: Area Chart format timestamp in Dashboards & Visualizations

Area Chart format timestamp

shangshin — Mon, 11 Jun 2012 20:38:54 GMT

Hi, I am creating an area chart to show my application's response time over the last 24 hours and each tick is the aggregrated average response time of 30 minutes

 | bucket _time span=30m | STATS avg(time_taken) BY _time

There are 2 questions:
1. Timeline on Y axis is not viewable because the original text (6/11/12 6:00:00.000 AM) is too long. How can I format it like 11AM, 2PM, etc?
2. How can I pick a different area chart color I prefer? by editting default.css?

Thanks!

Re: Area Chart format timestamp

araitz — Mon, 11 Jun 2012 21:18:03 GMT

You can use the fieldformat command to reformat _time:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fieldformat

Check out the charting.seriesColors option as documented here:

http://docs.splunk.com/Documentation/Splunk/4.3/Developer/CustomChartingConfig-FontColorBrushPalette

Re: Area Chart format timestamp

shangshin — Tue, 12 Jun 2012 19:34:34 GMT

I added the line
"0xFF0000"

but the area chart color doesn't change to red.
Any idea?

<?xml version='1.0' encoding='utf-8'?>

test

Response Time last 4 hrs
Test
area
0xFF0000
50
true

Re: Area Chart format timestamp

araitz — Tue, 12 Jun 2012 20:37:59 GMT

OK, totally my fault for not asking, but you are using what we call Simple XML.

To exercise greater control over things like charting colors, you would need to convert your existing view to Advanced XML - see http://splunk-base.splunk.com/answers/1/how-can-i-convert-simple-view-xml-to-advanced-xml if you want to go that route.

The reason you can't just use CSS is that the chart elements are canvas objects which are styled in-line.

Re: Area Chart format timestamp

shangshin — Tue, 12 Jun 2012 21:25:55 GMT

Thanks for the info. I found the link of the Simple XML
http://splunk:8000/en-US/app/search/TestDashboard

and also saw the advanced xml including the XML source.
http://splunk:8000/en-US/app/search/TestDashboard?showsource=1

However, the xml does have the foregroundcolor defined below. How come I still didn't see red in the area chart? Thanks!

0xFF0000
area

Re: Area Chart format timestamp

shangshin — Wed, 13 Jun 2012 16:37:35 GMT

I got it working. Thanks!

Re: Area Chart format timestamp

araitz — Wed, 13 Jun 2012 16:45:01 GMT

Awesome! Good work.