topic How to show non number values on y axis on a chart in Splunk Search

How to show non number values on y axis on a chart

matansocher — Tue, 04 Apr 2017 13:22:27 GMT

I have the following search and I would like to present instead of the 40 dummy values, the actual name of the field Report_Milestone.

the code I am using:

| inputcsv MilestonesCSV 
| dedup Report_Milestone 
| fieldformat TaskDeadline = strftime(TaskDeadline, "%d/%m/%Y") 
| eval milestoneNumber = 1
| eval Day1ofWeek = strftime(relative_time(TaskDeadline,"@w0"),"%d/%m/%y")
| table TaskDeadline Report_Milestone milestoneNumber Day1ofWeek
| chart sum(milestoneNumber) over Day1ofWeek by Report_Milestone

The chart output:

The y axis expects to see only number values, and instead of the 40 values, I would like to see the values on the left - the names ("Report_Milestone1").

Re: How to show non number values on y axis on a chart

DalJeanis — Tue, 04 Apr 2017 17:19:54 GMT

The quickest thing I would try is, change to this...

 | chart count over Day1ofWeek by Report_Milestone

...and switch the display format to show multiple independent series. That way you get one chart per report milestone, with one data point per milestone across the time in question.

It feels like chart is not the right tool for this, though I don't know offhand what the right one would be for displaying single, independently labeled events.

Re: How to show non number values on y axis on a chart

woodcock — Tue, 04 Apr 2017 20:21:16 GMT

I think that you would be better off with a custom visualization; check out these:

https://splunkbase.splunk.com/app/3120/
https://splunkbase.splunk.com/app/581/
https://splunkbase.splunk.com/app/1741/
https://splunkbase.splunk.com/app/3468/
https://splunkbase.splunk.com/app/3380/