topic X Axis (x-axis) don't show up in chart in Splunk Search

X Axis (x-axis) don't show up in chart

Joshie — Thu, 14 Feb 2013 08:33:35 GMT

I have created a chart (Bar) with the following:

chart count(ProductName) over ProductCalss BY StoreZones

Therer were quite a numbner of rows, and there was no problem displat them.
However, the X-Axis do not show the ProductName at all. The Y-Label shows the count accurately.

What could have caused this?

Many thanks!

Re: X Axis (x-axis) don't show up in chart

lguinn2 — Thu, 14 Feb 2013 08:46:04 GMT

You didn't ask for the ProductName to be displayed - you asked Splunk to count the number of events that contained a ProductName field. That's what count(ProductName) does. You asked to see this count displayed by ProductClass (I assume there was a typo in the name) and StoreZones.

If you just want a table, try this

yoursearchhere ProductName=*
| stats count by StoreZones ProductClass ProductName

If you really want a chart then go with

yoursearchhere ProductName=*
| chart count over StoreZones by ProductName

or some variant. Note that you can have as many break-out fields as you like in a stats command, but only two in a chart command. So you will have to pick two, or create a concatenated field, like this

yoursearchhere ProductName=*
| eval Product = ProductClass + ": " + ProductName
| chart count over StoreZones by Product

Re: X Axis (x-axis) don't show up in chart

Joshie — Fri, 15 Feb 2013 03:35:56 GMT

Hi Iguinn, thanks for your response.
However, what makes me ask the question is if I restrict to a smaller group (resulting in a smaller "product" range, the label came back.

So I am more incline to the limitation of the charting function.

Re: X Axis (x-axis) don't show up in chart

HattrickNZ — Wed, 20 Mar 2019 21:29:34 GMT

chart count by sentMessage | or chart count by sentMessage | did not make any difference to the x-axis for me. in either case the x-axis had no labels. have I understood the question/answer correctly?? tks