topic Re: How to change the scale of the distinct count of a field on a timechart? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-change-the-scale-of-the-distinct-count-of-a-field-on-a/m-p/142412#M39528 <P>Hi RVDowning,</P> <P>in the UI <CODE>visualization</CODE> tab, click on <CODE>Format</CODE> and select <CODE>Y-Axis</CODE>. There you can set the <CODE>Scale</CODE> to <CODE>Log</CODE> instead <CODE>Linear</CODE>.<BR /> Maybe this fits your needs.</P> <P>cheers, MuS</P> Fri, 26 Sep 2014 13:38:00 GMT MuS 2014-09-26T13:38:00Z How to change the scale of the distinct count of a field on a timechart? https://community.splunk.com/t5/Splunk-Search/How-to-change-the-scale-of-the-distinct-count-of-a-field-on-a/m-p/142411#M39527 <P>I have the following line:</P> <PRE><CODE>timechart span=1d sum(TypeAErrors) , sum(TypeBErrors), dc(racf) as "Unique Ids" </CODE></PRE> <P>but the dc(racf) is much larger than the other items displayed on the graph. I would ideally like dc(racf) / 10 so that it will scale more appropriately on the Y axis compared to the other two displayed items. But, I can't find any syntax that allows me to do this. Any ideas?</P> Fri, 26 Sep 2014 13:34:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-change-the-scale-of-the-distinct-count-of-a-field-on-a/m-p/142411#M39527 RVDowning 2014-09-26T13:34:03Z Re: How to change the scale of the distinct count of a field on a timechart? https://community.splunk.com/t5/Splunk-Search/How-to-change-the-scale-of-the-distinct-count-of-a-field-on-a/m-p/142412#M39528 <P>Hi RVDowning,</P> <P>in the UI <CODE>visualization</CODE> tab, click on <CODE>Format</CODE> and select <CODE>Y-Axis</CODE>. There you can set the <CODE>Scale</CODE> to <CODE>Log</CODE> instead <CODE>Linear</CODE>.<BR /> Maybe this fits your needs.</P> <P>cheers, MuS</P> Fri, 26 Sep 2014 13:38:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-change-the-scale-of-the-distinct-count-of-a-field-on-a/m-p/142412#M39528 MuS 2014-09-26T13:38:00Z Re: How to change the scale of the distinct count of a field on a timechart? https://community.splunk.com/t5/Splunk-Search/How-to-change-the-scale-of-the-distinct-count-of-a-field-on-a/m-p/142413#M39529 <P>Thanks for the suggestion, but the end user would totally freak. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> But they could follow a simple division by 10, so when the mouseover showed 26.2 they would know it was 262.</P> Fri, 26 Sep 2014 13:43:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-change-the-scale-of-the-distinct-count-of-a-field-on-a/m-p/142413#M39529 RVDowning 2014-09-26T13:43:31Z Re: How to change the scale of the distinct count of a field on a timechart? https://community.splunk.com/t5/Splunk-Search/How-to-change-the-scale-of-the-distinct-count-of-a-field-on-a/m-p/142414#M39530 <P>You can also try this:</P> <PRE><CODE>timechart span=1d sum(TypeAErrors) , sum(TypeBErrors), dc(eval(racf / 10)) as "Unique Ids" </CODE></PRE> Fri, 26 Sep 2014 13:46:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-change-the-scale-of-the-distinct-count-of-a-field-on-a/m-p/142414#M39530 wpreston 2014-09-26T13:46:47Z Re: How to change the scale of the distinct count of a field on a timechart? https://community.splunk.com/t5/Splunk-Search/How-to-change-the-scale-of-the-distinct-count-of-a-field-on-a/m-p/142415#M39531 <P>HeHe, sounds like <EM>do not trust any statistics, you did not fake yourself</EM></P> Fri, 26 Sep 2014 13:52:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-change-the-scale-of-the-distinct-count-of-a-field-on-a/m-p/142415#M39531 MuS 2014-09-26T13:52:32Z Re: How to change the scale of the distinct count of a field on a timechart? https://community.splunk.com/t5/Splunk-Search/How-to-change-the-scale-of-the-distinct-count-of-a-field-on-a/m-p/142416#M39532 <P>Oops, not qutie what I meant! Try this instead:</P> <PRE><CODE>timechart span=1d sum(TypeAErrors) , sum(TypeBErrors), dc(racf) as TempVal | eval TempVal=TempVal/10 | rename TempVal as "Unique IDs" </CODE></PRE> Fri, 26 Sep 2014 13:52:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-change-the-scale-of-the-distinct-count-of-a-field-on-a/m-p/142416#M39532 wpreston 2014-09-26T13:52:42Z Re: How to change the scale of the distinct count of a field on a timechart? https://community.splunk.com/t5/Splunk-Search/How-to-change-the-scale-of-the-distinct-count-of-a-field-on-a/m-p/142417#M39533 <P>That just gives me zeroes for dc(eval(racf / 10)). A "racf" is an alphanumeric ID. It is the count of these unique ids that I would like to divide by 10.</P> Fri, 26 Sep 2014 13:53:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-change-the-scale-of-the-distinct-count-of-a-field-on-a/m-p/142417#M39533 RVDowning 2014-09-26T13:53:37Z Re: How to change the scale of the distinct count of a field on a timechart? https://community.splunk.com/t5/Splunk-Search/How-to-change-the-scale-of-the-distinct-count-of-a-field-on-a/m-p/142418#M39534 <P>Yep, I realized that just a minute after I posted it, sorry about that (I blame a lack of caffine :-). The new search I posted should work exactly like you want.</P> Fri, 26 Sep 2014 13:57:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-change-the-scale-of-the-distinct-count-of-a-field-on-a/m-p/142418#M39534 wpreston 2014-09-26T13:57:29Z Re: How to change the scale of the distinct count of a field on a timechart? https://community.splunk.com/t5/Splunk-Search/How-to-change-the-scale-of-the-distinct-count-of-a-field-on-a/m-p/142419#M39535 <P>Yep, it works fine. Thanks much. I'm on my first cup of caffeine too. <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Fri, 26 Sep 2014 14:05:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-change-the-scale-of-the-distinct-count-of-a-field-on-a/m-p/142419#M39535 RVDowning 2014-09-26T14:05:03Z