topic Re: How to change timechart default y Axis default scale? in Splunk Search

How to change timechart default Y axis default scale?

wangkevin1029 — Mon, 19 Dec 2022 15:35:48 GMT

Hi，Splunkers,

I have a timechart, which have value for count by VQ less than 10, but default y axis scale is 100, which causes I can't see any column in my timechart.

how to change the y Axis scale to adjust automatically to my maximum value,

for example, if max value is less than 10, than default scale should be 10.

thx in advance.

kevin

Re: How to change timechart default y Axis default scale?

VatsalJagani — Sun, 18 Dec 2022 17:33:37 GMT

@wangkevin1029 - You can use the max value in the line chart on Y-Axis.

Consider upvoting if this helps!!!

Re: How to change timechart default y Axis default scale?

wangkevin1029 — Sun, 18 Dec 2022 17:44:20 GMT

Vatsal,

thx for your quick response.

My splunk ver doesn't have this configuration.

however I don't want a fixed max value. I need an automatic adjust max value here.

and it works in my other splunk, I compared all visualization configuration, they are same.

not sure why other one works.

for the working one, if the largest value is 7, then max scale is 10, if the largest value is 7500, then max scale is 10000.

Kevin

Re: How to change timechart default y Axis default scale?

wangkevin1029 — Sun, 18 Dec 2022 17:45:16 GMT

sorry, i have that max value, but I don't want a fixed max value.

Kevin

Re: How to change timechart default y Axis default scale?

wangkevin1029 — Sun, 18 Dec 2022 17:48:35 GMT

this is working one.

this is not working one, total aggragation result is 22, max value is 100, which I didn't configure it.

Re: How to change timechart default y Axis default scale?

VatsalJagani — Sun, 18 Dec 2022 18:03:51 GMT

@wangkevin1029 - Then you probably can try doing it under XML by setting it as a token and dynamically generating the token value as the max value.

some reference:

<search> <query>...</query> ... <done> <set token="tkn_max_value">$result.max_value$</set> </done> </search>

* Option for max value: "charting.axisX.maximumNumber"

<chart> <search> ... .. ... <option name="charting.axisX.maximumNumber">$tkn_max_value$</option> </chart>

* See more references - in Splunk's Simple XML reference document.

PS: I have personally not tried with chart configuration parameter but the token works with table options.

I hope this helps!!

Re: How to change timechart default y Axis default scale?

wangkevin1029 — Sun, 18 Dec 2022 18:51:02 GMT

thx, it looks a little complicated for me.

still not sure why my other timechart works as expected.

I will do more research.

thank you very much.

Kevin