topic Re: increase the size of a chart in Splunk Search

increase the size of a chart

infinitiguy — Mon, 28 Sep 2020 11:24:24 GMT

I'm using a bar chart (stacked) with a search query of sourcetype="log4j" | timechart count by log4j_ERROR_with_3_words

This gives me a top count of errors over the course of 30 days. Unfortunately the bar chart is really small and I only see 2 dates (Jan 16th and Jan 30th) with really small lines. I would love to increase the size of the chart so the X axis (date) can display more text - even every 5th day out of a 30 day spread would be better than what it's showing now.

Is this possible, and if so how? Below is the XML I'm using for the chart

  <row>
    <chart>
      <searchString>sourcetype="stash_log4j" | timechart count by   stash_log4j_ERROR_with_3_words</searchString>
      <title>30 Day error summary</title>
      <earliestTime>-30d@h</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.axisTitleX.text">Date</option>
      <option name="charting.axisTitleY.text">Number of total errors</option>
      <option name="charting.chart">bar</option>
      <option name="charting.chart.nullValueMode">gaps</option>
      <option name="charting.chart.stackMode">stacked</option>
      <option name="charting.layout.splitSeries">false</option>
      <option name="charting.legend.placement">bottom</option>
      <option name="charting.primaryAxisTitle.text"/>
      <option name="charting.secondaryAxis.maximumNumber">""</option>
      <option name="charting.secondaryAxis.minimumNumber">""</option>
      <option name="charting.secondaryAxis.scale">""</option>
      <option name="charting.secondaryAxisTitle.text"/>
      <option name="count">50</option>
      <option name="displayRowNumbers">true</option>
    </chart>
  </row>

Re: increase the size of a chart

Lamar — Mon, 28 Sep 2020 11:24:29 GMT

Use the span option for your timechart.

...| timechart span=1d count by stash_log4j_ERROR_with_3_words

Also, make sure you put a height option inside your charting options so you can modify the height.

<option name="charting.chart.height">500</option>

Re: increase the size of a chart

infinitiguy — Thu, 16 Feb 2012 03:54:39 GMT

do i need to use span to be able to set the height of my chart? I edited the xml and tried adding in the charting.chart.height but my chart would no longer draw. I tried from 500 up to 4500 but still no luck

Re: increase the size of a chart

infinitiguy — Thu, 16 Feb 2012 18:21:04 GMT

the below option allowed me to change the size of the chart

 <option name="height">1600</option>

I found the answer here:
http://splunk-base.splunk.com/answers/3885/set-height-of-chart-in-view-conf

charting.chart.height did not work

Re: increase the size of a chart

sansay — Tue, 22 Jul 2014 23:31:45 GMT

I just had to deal with this issue. I am surprised to not see any good answers.
So I had to figure it out:

<module name="FlashChart"> <param name="width">100%</param> <param name="height">350px</param> <module name="Gimp"/> <module name="ConvertToDrilldownSearch"> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> </module>

You have to specify the number, followed by px for pixels. If you put only the number it just won't work.
Also, note that this height is really the height of the chart itself. You have to account for an extra 50 pixels for the frame.