topic How to modify x-axis labels to show bin centers? in Splunk Search

How to modify x-axis labels to show bin centers?

rtakatsuka — Sat, 21 Nov 2020 05:56:04 GMT

I am trying to create a histogram plot, but I want to make the x-axis labels more readable. How do I go about doing this?

Here is what I am doing:

my search | bin field span 0.5 | chart count by field

Here is an example of the x-axis when create the chart. Is there a way to force the x-axis to show single values for each bin (at the bin center)? Or even better, can I force the x-axis to place integer labels at their respective positions relative to my bins?

Re: Modify x-axis labels to show bin centers

niketn — Wed, 12 Feb 2020 02:35:47 GMT

@rtakatsuka Please try the following:

my search 
| bin field span 0.5 
| chart count by field
| eval field=replace(field,"^([^-]+)-(.*)","\1")

This will retain the first part of the bin (before hyphen). If you need the second part of bin after hyphen, use \2 instead of \1 i.e. | eval field=replace(field,"^([^-]+)-(.*)","\2")

Following is a run anywhere example with cooked up sample data, based on the question:

| makeresults count=10 
| eval field=random(), field=substr(field,1,1), count=random(), count=substr(count,3) 
| bin field span=0.5
| chart sum(count) as count by field
| eval field=replace(field,"^([^-]+)-(.*)","\1")

Re: Modify x-axis labels to show bin centers

Splunknewbuiee — Sat, 21 Nov 2020 01:20:49 GMT

This works for positive numbers, but what about negative numbers? do we need to have some conditions for this case?