All Apps and Add-ons

How to show majorUnit and minorUnit on x-axis?

royimad
Builder

I need to draw a chart with 2 values on x-axis , how to do that?
Herby the code sample that i'm using:

<view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html">
<label>Web Services Trends</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="SideviewUtils" layoutPanel="appHeader"/>
<module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
</module>
<module name="Message" layoutPanel="messaging">
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
</module>
<module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
</module>
<module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" group="Sum of Claims" autoRun="True">
    <param name="savedSearch">RELEASECHECK2</param>

    <module name="HiddenChartFormatter">
        <param name="chart">line</param>
        <option name="charting.axisX">time</option>
        <param name="charting.axislabelsX.majorUnit">RELEASEDATE</param>
        <param name="charting.axislabelsX.minorUnit">RELEASENAME</param>
        <param name="charting.axislabelsY.majorUnit">data</param>
        <param name="charting.axislabelsY.minorUnit">data</param>

        <!--
        <param name="layout.axisLabelsX.minorTickVisibility">yes</param>
        <param name="layout.axisLabelsX.majorTickVisibility">yes</param>
        -->

        <option name="charting.axisX.comparator">RELEASENAME</option>

        <param name="primaryAxisTitle.text">x axis name</param>
        <param name="secondaryAxisTitle.text">y axis name</param>
        <module name="FlashChart"/>
    </module>

</module>  

</view>

sideview
SplunkTrust
SplunkTrust

That would be very cool if the charting framework could do that - if it could take two different fields RELEASEDATE and RELEASENAME, and use one for the major markers on the x-axis, and the other values for the minor-markers.

But I'm virtually certain that this is not possible. Someone else may surprise us here - it wouldn't be the first time that awesome functionality was deeply buried in the Splunk charting framework.

The good news is that I think you can get what you want by exploring charts like:

foo | chart count over RELEASEDATE by RELEASENAME   

and then graph that as a column chart. If you'd rather have the column bars stacked above eachother within a given RELEASEDATE, you can set charting.chart.stackMode to stacked.

NOTE: you're mixing simple-xml syntax inside your HiddenChartFormatter. Surprisingly I think the advanced XML wont throw any error, but it will be totally ignoring those <option> nodes. Replace them with equivalent <param> nodes if you want them to be used.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...