topic Re: How to set max y-axis value to a number derived from a search? in Splunk Search

How to set max y-axis value to a number derived from a search?

cspires64 — Tue, 02 Jun 2015 22:27:01 GMT

I need to base the max y-axis value to the number created from a search . . . how do I do that? I looked at hidden searches and HiddenChartFormatter, but I can't get it work. I want to define the variable and set it in XML and then set the max y-axis value to the variable.

Example:
variable=@max set @max=|search . . .

Re: How to set max y-axis value to a number derived from a search?

SwatiApte — Wed, 24 Jun 2015 13:47:43 GMT

Hi,

Could you please let me know if you had any luck with this problem. We have a similar need and would be great if someone can provide a solution or provide pointers for this.

Re: How to set max y-axis value to a number derived from a search?

cspires64 — Wed, 24 Jun 2015 15:01:17 GMT

I am still unaware of a solution for this issue.

Re: How to set max y-axis value to a number derived from a search?

koshyk — Wed, 24 Jun 2015 15:57:04 GMT

Which chart are you trying? Is it for Bar Chart? if then, you need to apply on "axisX" . Try hardcoding the @max value to test if it works.

<option name="charting.axisX.maximumNumber">2000</option>
<option name="charting.axisTitleX.text">axisTitleX TestName</option>

Re: How to set max y-axis value to a number derived from a search?

cspires64 — Wed, 24 Jun 2015 16:39:57 GMT

Hardcoding the axis will not solve the issue.

I need a to set a dynamic scale based on a search.

Use case: customer requests two charts that he compares daily. He wants both charts to have the same axis so he can easily compare them.

Option 1: combine the charts - this won't work; it makes the chart too busy and unreadable.
Option 2: hard code the scale of both charts - this won't work because values range greatly from day-to-day or depending on the slicers selected. Therefore, one day the scale would be correct and the next day the chart would be nothing but white space.
Option 3: have a dynamic scale based on a hidden search. This is what we are currently trying to do. create a search to find the max value from both charts and then set that value as the max on the y-axis for both charts.

As far as I know, there is not a solution for this issue.

Re: How to set max y-axis value to a number derived from a search?

chahal3108 — Wed, 30 Sep 2015 09:13:56 GMT

Hi,

You can achieve this. First, create a hidden dropdown with dynamic options. Pass your query to calculate the maximum y-axis range from this. Now the dropdown token will have that max value. Then use that token, say max_count, as folows:

<option name="charting.axisY.maximumNumber">$max_count$</option>

So, the code will look like this (intentionally removed other options for better visibility):

<fieldset submitButton="false" autoRun="true">
    <input type="dropdown" token="max_count" searchWhenChanged="true" depends="$xyz$"> //any non-existing token for depends
      <label>Count</label>
      <selectFirstChoice>true</selectFirstChoice>
      <populatingSearch earliest="0" latest="" fieldForLabel="Count" fieldForValue="Count">query</populatingSearch>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Title</title>
        <searchString>query</searchString>
        <earliestTime>$InputTime.earliest$</earliestTime>
        <latestTime>$InputTime.latest$</latestTime>
        <option name="charting.axisY.maximumNumber">$max_count$</option>
        <option name="charting.chart">column</option>
      </chart>
    </panel>
  </row>

Hope this helps !!!!

PS: Tested on Splunk 6.2+

Re: How to set max y-axis value to a number derived from a search?

avisram — Tue, 05 Apr 2016 20:49:56 GMT

Hi chahal3108,

How would you edit the populatingSearch so that you can use a token from a time range picker input on the form for the earliest and latest search parameters? My max_count value needs to be based on a dynamic time range as opposed to a fixed time range.

Thanks.

Re: How to set max y-axis value to a number derived from a search?

chahal3108 — Thu, 07 Apr 2016 11:48:55 GMT

Hi avsiram,

You have earliest and latest available under populating search tag. Just pass your input time picker variable under those.
e.g.

<populatingSearch earliest="$InputTime.earliest$" latest="$InputTime.latest$" fieldForLabel="Count" fieldForValue="Count">query</populatingSearch>

Re: How to set max y-axis value to a number derived from a search?

avisram — Thu, 07 Apr 2016 15:42:19 GMT

I was able to incorporate the time token directly into the query string. This now works when the chart is initially displayed, however when I change the time range from the picker the previous value is retained in the Count field with the updated value being displayed as a selection under from the drop-down. I have "unset" the max_count token when the time range is changed however this has not resolved the issue. Any further suggestions?