topic Re: Scale Y axis for timechart in Splunk Search

Scale Y axis for timechart

kkao00 — Mon, 17 Sep 2012 20:22:46 GMT

Hi,

I run a real time query in splunk search during load testing, and it comes out like this:

http://picpaste.com/pics/splunk_timechart-vCg4doz1.1347913377.PNG

I'd like to be able to divide the y-axis by 60. So instead of 200/400/600/800 it'd be 3.33/6.66/10/etc. Can this be done?

The query is sourcetype="access-prod-wcs" useragent = "CLOUDTEST-SOASTA" OR useragent = "Lr-Perf" OrderProcessCmd | timechart count by sitefamily

Thanks

Re: Scale Y axis for timechart

melting — Mon, 17 Sep 2012 20:55:17 GMT

I think you just want to eval count to what you want

ex:
... | eval(count(source)/60)

So your search:
sourcetype="access-prod-wcs" useragent = "CLOUDTEST-SOASTA" OR useragent = "Lr-Perf" OrderProcessCmd | timechart eval(count(sitefamily)/60) by sitefamily

Other timechart commands:
CommonStatsFunctions

Re: Scale Y axis for timechart

kkao00 — Tue, 18 Sep 2012 13:26:18 GMT

Didn't seem to work...Shows the same chart as the original query.

Re: Scale Y axis for timechart

melting — Tue, 18 Sep 2012 16:01:14 GMT

I edited my answer. I had an ever simplified version of your search. Take look at my edited answer.

Re: Scale Y axis for timechart

kkao00 — Wed, 19 Sep 2012 18:45:21 GMT

Thank you!!!