topic Re: I have 90 days data and i want to display in column chart. i am getting all the data but x axis label is missing. how to fix it in Splunk Search

I have 90 days data and i want to display in column chart. i am getting all the data but x axis label is missing. how to fix it

DataOrg — Wed, 12 Jul 2017 06:25:34 GMT

X axis label is missing. if i reduce the no of data i am getting label. how to accommodate all data with x axis label

Re: I have 90 days data and i want to display in column chart. i am getting all the data but x axis label is missing. how to fix it

niketn — Wed, 12 Jul 2017 06:37:49 GMT

@premranjithj, try rotating the axis label by 90 degrees.

<option name="charting.axisLabelsX.majorLabelStyle.rotation">90</option>

https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference

You can also see having only one panel per row, that will accommodate more data points in the chart. How many data points do you have? Is it one per day? You can format time on X-axis for display in shorter format using fieldformat command. For example:

| fieldformat _time=strftime(_time,"%m-%d")

Re: I have 90 days data and i want to display in column chart. i am getting all the data but x axis label is missing. how to fix it

DataOrg — Wed, 12 Jul 2017 08:06:35 GMT

its one per day. i am not able to plot still after changing to 90

Re: I have 90 days data and i want to display in column chart. i am getting all the data but x axis label is missing. how to fix it

niketn — Wed, 12 Jul 2017 09:10:45 GMT

You can perform | head 60 or | head 50 to see how many labels can be displayed in x-axis as per your display area width. While 90 did not work for me 60 did.

If x-axis is _time epoch field, and you are using timechart command to plot your series then x-axis will adjust time labels to be displayed. You can also check out Punchcard visualization to see if it fits depicting the visualization as you require.

Re: I have 90 days data and i want to display in column chart. i am getting all the data but x axis label is missing. how to fix it

DataOrg — Wed, 12 Jul 2017 09:51:03 GMT

head 60 or head 50 will work.. is there any possibility to display all the values

Re: I have 90 days data and i want to display in column chart. i am getting all the data but x axis label is missing. how to fix it

niketn — Wed, 12 Jul 2017 10:20:23 GMT

I think with Column chart one of the options is to reduce browser display size to less than 100% so that available width for the chart increases. Can you check out Puchcard Custom Visualization whether it fits the need? Punchcard can display more labels in x-axis however it may overlap values.

Re: I have 90 days data and i want to display in column chart. i am getting all the data but x axis label is missing. how to fix it

niketn — Wed, 12 Jul 2017 10:20:55 GMT

Can you share at least the final pipe for generating stats for display?

Re: I have 90 days data and i want to display in column chart. i am getting all the data but x axis label is missing. how to fix it

DataOrg — Wed, 12 Jul 2017 10:54:23 GMT

|stats sum(INcome) sum(spending) max(remaining) by TS.
i use remaining as overlay

Re: I have 90 days data and i want to display in column chart. i am getting all the data but x axis label is missing. how to fix it

niketn — Wed, 12 Jul 2017 12:01:46 GMT

What is TS? can you add some sample values for TS

Re: I have 90 days data and i want to display in column chart. i am getting all the data but x axis label is missing. how to fix it

DataOrg — Wed, 12 Jul 2017 12:47:46 GMT

TS is date value

Re: I have 90 days data and i want to display in column chart. i am getting all the data but x axis label is missing. how to fix it

niketn — Wed, 12 Jul 2017 15:02:33 GMT

Is it date in string format or epoch format? The reason why I ask is if you switch to timechart instead of stats, then x-axis will adjust on its own.

For example:

| eval TS=strptime(TS,"%Y/%m/%d")
| eval _time=TS
| timechart span=1d sum(INcome) as Income sum(spending) as Expense max(remaining) as Saving

PS: eval with strptime() will not be required if TS is epoch time. This eval is required only if TS is string time.

Re: I have 90 days data and i want to display in column chart. i am getting all the data but x axis label is missing. how to fix it

niketn — Thu, 13 Jul 2017 07:03:04 GMT

@premranjithj, I am converting my comments to answer. If these comments have helped, please accept to mark this question as answered.