topic Re: How to change x-axis increments on a column chart? in Splunk Search

How to change x-axis increments on a column chart?

brianlee12 — Tue, 12 Jul 2016 17:45:07 GMT

I have a column chart with 4 bars, with the values 2, 10, 46, and 50. The spacing between these 4 bars are the same as Splunk treats the values as labels. I'd like to space the bars out proportional to their x-axis value, so the space between the 10 bar and 46 bar would be much greater than the spacing between 46 and 50, etc. Any help would be appreciated thanks 🙂

Re: How to change x-axis increments on a column chart?

somesoni2 — Tue, 12 Jul 2016 18:23:02 GMT

Can you post the search OR the table of final values you've?

Re: How to change x-axis increments on a column chart?

brianlee12 — Tue, 12 Jul 2016 18:26:47 GMT

My search is:

... |   stats sum(uploadSize) as totalUploadSize sum(uploadDuration) as totalUploadDuration by deviceID |   eval bandwidth= round((totalUploadSize)/(totalUploadDuration*0.001*131072),4) |  table deviceID bandwidth | stats count by bandwidth | sort + bandwidth

currently it looks like

Re: How to change x-axis increments on a column chart?

somesoni2 — Tue, 12 Jul 2016 18:35:30 GMT

Give this a try

 ... | stats sum(uploadSize) as totalUploadSize sum(uploadDuration) as totalUploadDuration by deviceID | eval bandwidth= round((totalUploadSize)/(totalUploadDuration*0.001*131072),4)  | stats count by bandwidth  | eval t=bandwidth | chart values(count) over bandwidth by t

Re: How to change x-axis increments on a column chart?

brianlee12 — Tue, 12 Jul 2016 18:42:45 GMT

The bars are being spaced out a lot but the spacing is still constant not proportional

Re: How to change x-axis increments on a column chart?

somesoni2 — Tue, 12 Jul 2016 18:51:13 GMT

The column spacing is exactly same as value of "bandwidth"? Do you want it to be spaced out based of value of "count"? OR if you could post snapshot of your expected graph.

Re: How to change x-axis increments on a column chart?

brianlee12 — Tue, 12 Jul 2016 18:58:27 GMT

This is what I'm looking for

Re: How to change x-axis increments on a column chart?

somesoni2 — Tue, 12 Jul 2016 19:05:55 GMT

Give this a try

... | stats sum(uploadSize) as totalUploadSize sum(uploadDuration) as totalUploadDuration by deviceID | eval bandwidth= round((totalUploadSize)/(totalUploadDuration*0.001*131072),4)  | stats count by bandwidth  | eval _time=relative_time(now(),"@d") + bandwidth | timechart span=10s values(count)  by bandwidth | eval t=round(_time-relative_time(now(),"@d")) | fields - _time | table t *

Re: How to change x-axis increments on a column chart?

brianlee12 — Tue, 12 Jul 2016 20:41:22 GMT

This is the result

Re: How to change x-axis increments on a column chart?

somesoni2 — Tue, 12 Jul 2016 20:53:16 GMT

Something is wrong (negative t shouldn't come) . This should give number of rows equal to max of bandwidth. Can you try this

... | stats sum(uploadSize) as totalUploadSize sum(uploadDuration) as totalUploadDuration by deviceID | eval bandwidth= round((totalUploadSize)/(totalUploadDuration*0.001*131072),4)  | stats count by bandwidth  | eval _time=relative_time(now(),"@d") + bandwidth | timechart span=10s values(count)  by bandwidth | eval t=round(_time-relative_time(now(),"@d")) | fields - _time | table t * |where  t>0

Re: How to change x-axis increments on a column chart?

brianlee12 — Tue, 12 Jul 2016 21:03:29 GMT

It says no results found when I do that

Re: How to change x-axis increments on a column chart?

brianlee12 — Tue, 12 Jul 2016 21:04:04 GMT

So are you trying to set the bandwidth as the time, that way I can use a timechart to display the information?

Re: How to change x-axis increments on a column chart?

sundareshr — Tue, 12 Jul 2016 21:05:43 GMT

If you know the max value, you could try this

... | stats sum(uploadSize) as totalUploadSize sum(uploadDuration) as totalUploadDuration by deviceID | eval bandwidth= round((totalUploadSize)/(totalUploadDuration*0.001*131072),4) | table deviceID bandwidth | stats count by bandwidth | sort + bandwidth | append [ gentimes start=-1 | eval bandwidth=mvrange(0, maxvalue, .1) | mvexpand bandwidth | table bandwidth ] | stats values(count) as count by bandwidth

Re: How to change x-axis increments on a column chart?

sundareshr — Tue, 12 Jul 2016 21:09:02 GMT

If you don't know the max, try this...

... | stats sum(uploadSize) as totalUploadSize sum(uploadDuration) as totalUploadDuration by deviceID | eval bandwidth= round((totalUploadSize)/(totalUploadDuration*0.001*131072),4) | table deviceID bandwidth | stats count by bandwidth | sort + bandwidth | append [ search ... | stats sum(uploadSize) as totalUploadSize sum(uploadDuration) as totalUploadDuration by deviceID | eval bandwidth= round((totalUploadSize)/(totalUploadDuration*0.001*131072),4) | stats max(bandwidth) as maxvalue | eval bandwidth=mvrange(0, maxvalue, .1) | mvexpand bandwidth | table bandwidth ] | stats values(count) as count by bandwidth

Re: How to change x-axis increments on a column chart?

somesoni2 — Tue, 12 Jul 2016 21:09:14 GMT

To make x-axis markers to space out based on the x column value, I'm adding current day and then after chart substracting current day into the bandwidth. Thus there should never be a negative value for column t. Can you try this and if it doesn't work, provide the full search that you're using?

... | stats sum(uploadSize) as totalUploadSize sum(uploadDuration) as totalUploadDuration by deviceID | eval bandwidth= round((totalUploadSize)/(totalUploadDuration*0.001*131072),4)  | stats count by bandwidth | eval _time=bandwidth | timechart span=2 values(count)  by bandwidth | eval t=_time | fields - _time | table t *

Re: How to change x-axis increments on a column chart?

brianlee12 — Tue, 12 Jul 2016 21:40:52 GMT

This is very close. The bars are currently being squished to the left side

Re: How to change x-axis increments on a column chart?

brianlee12 — Tue, 12 Jul 2016 21:45:08 GMT

your first post kind of worked, for some reason its going in order of the first digit so the 2.12 value is showing up after 10

Re: How to change x-axis increments on a column chart?

brianlee12 — Tue, 12 Jul 2016 21:46:05 GMT

fixed it by sorting it