<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic I have a chart question in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/I-have-a-chart-question/m-p/103392#M5850</link>
    <description>&lt;P&gt;Well hello there....&lt;/P&gt;

&lt;P&gt;I have been reading about the charting options and I'm still a bit lost on how to change something.&lt;/P&gt;

&lt;P&gt;I originally had a single value display that looked like this on a dashboard:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;label&amp;gt;Balance Email Summary - Last 24 Hours&amp;lt;/label&amp;gt;
&amp;lt;row&amp;gt;
&amp;lt;single&amp;gt;
  &amp;lt;title&amp;gt;Total Emails To Send For All Registries&amp;lt;/title&amp;gt;
  &amp;lt;searchName&amp;gt;balance_email_to_send&amp;lt;/searchName&amp;gt;
  &amp;lt;fields&amp;gt;TotalEmailsToSend&amp;lt;/fields&amp;gt;
&amp;lt;/single&amp;gt;
&amp;lt;single&amp;gt;
  &amp;lt;title&amp;gt;Total Emails Sent To All Registries&amp;lt;/title&amp;gt;
  &amp;lt;searchName&amp;gt;balance_email_sent&amp;lt;/searchName&amp;gt;
  &amp;lt;fields&amp;gt;TotalEmailsSent&amp;lt;/fields&amp;gt;
&amp;lt;/single&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I now wanted to take out the single and make it into a chart.  The problem is if I do that, the values at the bottom of the chart are not reflecting on the numbers that are present after the search is complete.  The numbers only go from 0-100 and I really would need them to go from like 1000 to 2000.&lt;/P&gt;

&lt;P&gt;How can you change the numbers at the bottom of the chart?  &lt;/P&gt;</description>
    <pubDate>Sat, 11 Dec 2010 03:39:36 GMT</pubDate>
    <dc:creator>gnovak</dc:creator>
    <dc:date>2010-12-11T03:39:36Z</dc:date>
    <item>
      <title>I have a chart question</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/I-have-a-chart-question/m-p/103392#M5850</link>
      <description>&lt;P&gt;Well hello there....&lt;/P&gt;

&lt;P&gt;I have been reading about the charting options and I'm still a bit lost on how to change something.&lt;/P&gt;

&lt;P&gt;I originally had a single value display that looked like this on a dashboard:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;label&amp;gt;Balance Email Summary - Last 24 Hours&amp;lt;/label&amp;gt;
&amp;lt;row&amp;gt;
&amp;lt;single&amp;gt;
  &amp;lt;title&amp;gt;Total Emails To Send For All Registries&amp;lt;/title&amp;gt;
  &amp;lt;searchName&amp;gt;balance_email_to_send&amp;lt;/searchName&amp;gt;
  &amp;lt;fields&amp;gt;TotalEmailsToSend&amp;lt;/fields&amp;gt;
&amp;lt;/single&amp;gt;
&amp;lt;single&amp;gt;
  &amp;lt;title&amp;gt;Total Emails Sent To All Registries&amp;lt;/title&amp;gt;
  &amp;lt;searchName&amp;gt;balance_email_sent&amp;lt;/searchName&amp;gt;
  &amp;lt;fields&amp;gt;TotalEmailsSent&amp;lt;/fields&amp;gt;
&amp;lt;/single&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I now wanted to take out the single and make it into a chart.  The problem is if I do that, the values at the bottom of the chart are not reflecting on the numbers that are present after the search is complete.  The numbers only go from 0-100 and I really would need them to go from like 1000 to 2000.&lt;/P&gt;

&lt;P&gt;How can you change the numbers at the bottom of the chart?  &lt;/P&gt;</description>
      <pubDate>Sat, 11 Dec 2010 03:39:36 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/I-have-a-chart-question/m-p/103392#M5850</guid>
      <dc:creator>gnovak</dc:creator>
      <dc:date>2010-12-11T03:39:36Z</dc:date>
    </item>
    <item>
      <title>Re: I have a chart question</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/I-have-a-chart-question/m-p/103393#M5851</link>
      <description>&lt;P&gt;Can you add the search that you're using?   Also the simplified XML converts to advanced XML under the hood and there's often problems in the conversion -- tacking ?showsource=1 on the URL, scrolling down and copying-and-pasting the advanced XML may reveal where it's gone wrong.&lt;/P&gt;</description>
      <pubDate>Sat, 11 Dec 2010 03:46:35 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/I-have-a-chart-question/m-p/103393#M5851</guid>
      <dc:creator>sideview</dc:creator>
      <dc:date>2010-12-11T03:46:35Z</dc:date>
    </item>
    <item>
      <title>Re: I have a chart question</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/I-have-a-chart-question/m-p/103394#M5852</link>
      <description>&lt;P&gt;The search for "balance_email_to_send" looks like this:&lt;/P&gt;

&lt;P&gt;sourcetype="cron_BalanceEmail" (source="&lt;EM&gt;asia&lt;/EM&gt;" OR source="&lt;EM&gt;info&lt;/EM&gt;" OR source="&lt;EM&gt;org&lt;/EM&gt;") starthoursago="24" BalanceEmail sent | rex field=_raw "[BalanceEmail] ?(?&lt;TOTALEMAILSSENT&gt;[\d]+) of (?&lt;TOTALEMAILSTOSEND&gt;[\d]+) of email notification sent." | search TotalEmailsToSend="*" | chart sum(TotalEmailsToSend)&lt;/TOTALEMAILSTOSEND&gt;&lt;/TOTALEMAILSSENT&gt;&lt;/P&gt;</description>
      <pubDate>Mon, 28 Sep 2020 09:21:58 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/I-have-a-chart-question/m-p/103394#M5852</guid>
      <dc:creator>gnovak</dc:creator>
      <dc:date>2020-09-28T09:21:58Z</dc:date>
    </item>
    <item>
      <title>Re: I have a chart question</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/I-have-a-chart-question/m-p/103395#M5853</link>
      <description>&lt;P&gt;advanced xml is here i believe:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;  &amp;lt;module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" group="Total Emails To Send For All Registries" autoRun="True"&amp;gt;
&amp;lt;param name="savedSearch"&amp;gt;balance_email_to_send&amp;lt;/param&amp;gt;
&amp;lt;param name="groupLabel"&amp;gt;Total Emails To Send For All Registries&amp;lt;/param&amp;gt;
&amp;lt;module name="ViewstateAdapter"&amp;gt;
  &amp;lt;param name="savedSearch"&amp;gt;balance_email_to_send&amp;lt;/param&amp;gt;
  &amp;lt;module name="HiddenFieldPicker"&amp;gt;
    &amp;lt;param name="fields"&amp;gt;TotalEmailsToSend&amp;lt;/param&amp;gt;
    &amp;lt;param name="strictMode"&amp;gt;True&amp;lt;/param&amp;gt;
    &amp;lt;module name="JobProgressIndicator"&amp;gt;
      &amp;lt;module name="EnablePreview"&amp;gt;
        &amp;lt;param name="enable"&amp;gt;True&amp;lt;/param&amp;gt;
        &amp;lt;param name="display"&amp;gt;False&amp;lt;/param&amp;gt;
        &amp;lt;module name="HiddenChartFormatter"&amp;gt;
          &amp;lt;param name="charting.chart"&amp;gt;bar&amp;lt;/param&amp;gt;
          &amp;lt;module name="FlashChart"&amp;gt;
            &amp;lt;param name="width"&amp;gt;100%&amp;lt;/param&amp;gt;
            &amp;lt;param name="height"&amp;gt;400&amp;lt;/param&amp;gt;
            &amp;lt;module name="ConvertToDrilldownSearch"&amp;gt;
              &amp;lt;module name="ViewRedirector"&amp;gt;
                &amp;lt;param name="viewTarget"&amp;gt;flashtimeline&amp;lt;/param&amp;gt;
              &amp;lt;/module&amp;gt;
            &amp;lt;/module&amp;gt;
          &amp;lt;/module&amp;gt;
          &amp;lt;module name="ViewRedirectorLink"&amp;gt;
            &amp;lt;param name="viewTarget"&amp;gt;flashtimeline&amp;lt;/param&amp;gt;
          &amp;lt;/module&amp;gt;
        &amp;lt;/module&amp;gt;
      &amp;lt;/module&amp;gt;
    &amp;lt;/module&amp;gt;
  &amp;lt;/module&amp;gt;
&amp;lt;/module&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;&lt;/P&gt;</description>
      <pubDate>Sat, 11 Dec 2010 04:52:17 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/I-have-a-chart-question/m-p/103395#M5853</guid>
      <dc:creator>gnovak</dc:creator>
      <dc:date>2010-12-11T04:52:17Z</dc:date>
    </item>
  </channel>
</rss>

