Splunk Search

Y-axis label using sideview utils

strive
Influencer

Hi,

By default, sideview displays stat(field) as legend and Y-axis label. We want to show just field as legend. We are able to achieve that by doing some modifications in JS file. We want to change Y-axis label as well. How to do it?

Say BytesDelivered is the metric under consideration. We are able to show Bytes Delivered as legend. Same is displayed as Y-axis label. We want to show GB as Y-axis label.

Thanks

Strive

Tags (2)
1 Solution

sideview
SplunkTrust
SplunkTrust

I could implement this as a general feature in the Sideview Report Builder, in that I could provide a lookup or two, ship them empty, and tell customers how to add entries to them so as to a) map field names to the names they want to appear in the legend, and b) map field names to names they want to appear in headers.

However, I've thought about it and it's far too complicated to try and explain step by step. Sideview Report Builder with its automatic pivoting and drilldown behavior, has a lot of moving parts already. Furthermore, I think the only real way to change the field names in JSChart's legend is to.... literally change the field name, and this would perturb the entire automatic drilldown stuff that the Sideview Report Builder has going on.

(To explain: in Splunk's general UI's, a drilldown always takes you to raw events. In Sideview Report Builder, a drilldown always plugs in the arguments (even if they're NULL/OTHER), but leaves you in the report builder. Whatever you drilldown down on in the x-axis and whatever was in the 'split-by' UI is now added as new searchterms, and you're looking at a "count of events over time" for those drilldown events.)

Of course, if you have a particular report that you're interested in, why not use the Report Builder's "Create dashboard" abilities to create your own dashboard from that report... Then you can edit the search language once it's created and use rename and eval as necessary to turn it into GB and rename the field in the legend, etc...

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

I could implement this as a general feature in the Sideview Report Builder, in that I could provide a lookup or two, ship them empty, and tell customers how to add entries to them so as to a) map field names to the names they want to appear in the legend, and b) map field names to names they want to appear in headers.

However, I've thought about it and it's far too complicated to try and explain step by step. Sideview Report Builder with its automatic pivoting and drilldown behavior, has a lot of moving parts already. Furthermore, I think the only real way to change the field names in JSChart's legend is to.... literally change the field name, and this would perturb the entire automatic drilldown stuff that the Sideview Report Builder has going on.

(To explain: in Splunk's general UI's, a drilldown always takes you to raw events. In Sideview Report Builder, a drilldown always plugs in the arguments (even if they're NULL/OTHER), but leaves you in the report builder. Whatever you drilldown down on in the x-axis and whatever was in the 'split-by' UI is now added as new searchterms, and you're looking at a "count of events over time" for those drilldown events.)

Of course, if you have a particular report that you're interested in, why not use the Report Builder's "Create dashboard" abilities to create your own dashboard from that report... Then you can edit the search language once it's created and use rename and eval as necessary to turn it into GB and rename the field in the legend, etc...

0 Karma

strive
Influencer

Hi, I am talking about Sideview Report Builder

0 Karma

sideview
SplunkTrust
SplunkTrust

Are you talking about the Sideview Report Builder? Or are you talking about a custom view that you've developed on your own? If the latter can you include the XML for the view?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...