Dashboards & Visualizations

Area Chart format timestamp

shangshin
Builder

Hi, I am creating an area chart to show my application's response time over the last 24 hours and each tick is the aggregrated average response time of 30 minutes

 | bucket _time span=30m | STATS avg(time_taken) BY _time

There are 2 questions:
1. Timeline on Y axis is not viewable because the original text (6/11/12 6:00:00.000 AM) is too long. How can I format it like 11AM, 2PM, etc?
2. How can I pick a different area chart color I prefer? by editting default.css?

Thanks!

Tags (1)
1 Solution

araitz
Splunk Employee
Splunk Employee
0 Karma

araitz
Splunk Employee
Splunk Employee

You can use the fieldformat command to reformat _time:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fieldformat

Check out the charting.seriesColors option as documented here:

http://docs.splunk.com/Documentation/Splunk/4.3/Developer/CustomChartingConfig-FontColorBrushPalette
0 Karma

araitz
Splunk Employee
Splunk Employee

Awesome! Good work.

shangshin
Builder

I got it working. Thanks!

shangshin
Builder

Thanks for the info. I found the link of the Simple XML
http://splunk:8000/en-US/app/search/TestDashboard

and also saw the advanced xml including the XML source.
http://splunk:8000/en-US/app/search/TestDashboard?showsource=1

However, the xml does have the foregroundcolor defined below. How come I still didn't see red in the area chart? Thanks!


0xFF0000
area

0 Karma

araitz
Splunk Employee
Splunk Employee

OK, totally my fault for not asking, but you are using what we call Simple XML.

To exercise greater control over things like charting colors, you would need to convert your existing view to Advanced XML - see http://splunk-base.splunk.com/answers/1/how-can-i-convert-simple-view-xml-to-advanced-xml if you want to go that route.

The reason you can't just use CSS is that the chart elements are canvas objects which are styled in-line.

shangshin
Builder

I added the line
"0xFF0000"

but the area chart color doesn't change to red.
Any idea?

<?xml version='1.0' encoding='utf-8'?>




Response Time last 4 hrs
Test
area
0xFF0000
50
true


0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...