Dashboards & Visualizations

How do I get the labels on the X-axis in this graph?

HattrickNZ
Motivator

How do I get the labels on the X-axis in this graph?
Ideally I would like the labels to be 0 - 129157 on the xaxis from left to right.

graph with no labels on x-axis

I think I may have to use a bin option(3/ reference below), which I may ask elsewhere but I thought I would ask this specific question first.

1/ https://answers.splunk.com/answers/584026/splunk-dashboard-timechart-x-axis-does-not-show-ho-1.html
2/ https://answers.splunk.com/answers/75828/x-axis-x-axis-dont-show-up-in-chart.html
3/ https://answers.splunk.com/answers/549858/how-to-display-numeric-x-axis-labels-on-line-chart.html
4/ https://answers.splunk.com/answers/557511/how-can-i-show-all-labels-on-x-axis-even-results-a.html

I can get the labels to appear on the xaxis with this sample search:

| makeresults 
     | eval data = "
1    10;
2    9;
3    8;
4    7;
5    6;
6    5;
7    4;
8    3;
9    2;
10   1;
    " 
     | makemv delim=";" data
     | mvexpand data
     | rex field=data "(?<Date>\d+)\s+(?<Y>\d+)"
     | fields + Date Y | fields - _time
     |search Y = * | 
     chart count(Y) by Y | sort + Y

This is my sample search to simulate the pic above

| makeresults 
     | eval data = "
0   50;
1   57;
2   89;
3   196;
4   293;
5   424;
6   481;
7   518;
8   527;
9   501;
10  526;
11  452;
12  424;
13  373;
14  338;
15  301;
16  271;
17  258;
18  242;
19  217;
20  196;
21  176;
22  194;
23  180;
24  139;
25  146;
26  116;
27  143;
28  109;
29  103;
30  104;
31  117;
32  108;
33  89;
34  104;
35  86;
36  97;
37  102;
38  87;
39  81;
40  77;
41  88;
42  81;
43  68;
44  88;
45  72;
46  75;
47  88;
48  75;
49  70;
50  69;
51  59;
52  65;
53  60;
54  62;
55  62;
56  63;
57  70;
58  63;
59  51;
60  56;
61  45;
62  63;
63  62;
64  57;
65  39;
66  54;
67  48;
68  38;
69  53;
70  47;
71  51;
72  46;
73  52;
74  47;
75  48;
76  40;
77  43;
78  41;
79  36;
80  35;
81  31;
82  45;
83  41;
84  29;
85  42;
86  42;
87  39;
88  50;
89  33;
90  47;
91  42;
92  35;
93  32;
94  29;
95  48;
96  48;
97  40;
98  62;
99  46;
100 50;
101 49;
102 48;
103 59;
104 38;
105 57;
106 64;
107 65;
108 54;
109 79;
110 58;
111 76;
112 81;
113 59;
114 77;
115 80;
116 82;
117 88;
118 79;
119 101;
120 86;
121 104;
122 111;
123 93;
124 98;
125 114;
126 104;
127 123;
128 122;
129 137;
130 146;
131 131;
132 147;
133 117;
134 145;
135 165;
136 144;
137 178;
138 170;
139 169;
140 169;
141 159;
142 169;
143 177;
144 159;
145 195;
146 158;
147 193;
148 186;
149 199;
150 184;
151 181;
152 209;
153 187;
154 197;
155 196;
156 209;
157 183;
158 207;
159 214;
160 184;
161 238;
162 215;
163 194;
164 229;
165 239;
166 249;
167 216;
168 240;
169 197;
170 234;
171 237;
172 243;
173 240;
174 262;
175 255;
176 238;
177 245;
178 229;
179 224;
180 225;
181 226;
182 224;
183 244;
184 237;
185 222;
186 214;
187 189;
188 210;
189 209;
190 214;
191 216;
192 213;
193 200;
194 197;
195 199;
196 186;
197 187;
198 174;
199 163;
200 166;
201 188;
202 157;
203 170;
204 140;
205 141;
206 142;
207 143;
208 120;
209 140;
210 146;
211 119;
212 96;
213 131;
214 107;
215 111;
216 99;
217 109;
218 119;
219 95;
220 103;
221 98;
222 87;
223 79;
224 70;
225 76;
226 88;
227 79;
228 79;
229 68;
230 71;
231 64;
232 63;
233 61;
234 47;
235 59;
236 54;
237 46;
238 34;
239 41;
240 36;
241 30;
242 38;
243 27;
244 36;
245 24;
246 34;
247 23;
248 19;
249 26;
250 23;
251 21;
252 17;
253 12;
254 18;
255 15;
256 14;
257 9;
258 5;
259 9;
260 10;
261 6;
262 10;
263 10;
264 5;
265 3;
266 5;
267 6;
268 2;
269 2;
270 4;
271 1;
272 6;
273 3;
274 2;
275 2;
276 2;
277 1;
279 1;
280 1;
281 1;
282 1;
283 1;
284 1;
285 1;
286 1;
288 2;
289 1;
292 1;
295 1;
298 1;
299 1;
300 1;
304 1;
376 1;
377 1;
712 1;
942 1;
1097    1;
1299    1;
1455    1;
4978    1;
5240    1;
5979    1;
6060    1;
6432    1;
6617    1;
7168    1;
7182    1;
7211    1;
7231    1;
7253    1;
7280    1;
7285    1;
7286    1;
7331    1;
7351    1;
7356    1;
7386    1;
7444    1;
7457    1;
7465    1;
7468    1;
7592    1;
7616    1;
7620    1;
7656    1;
127017  1;
127376  1;
129157  1;

    " 
     | makemv delim=";" data
     | mvexpand data
     | rex field=data "(?<sentMessage>\d+)\s+(?<count>\d+)"
     | fields + sentMessage count | fields - _time
0 Karma
1 Solution

cmerriman
Super Champion

I think there are just too many data points for it to show up on the axis. if you bin, they'll show up.

| makemv delim=";" data
  | mvexpand data
  | rex field=data "(?<sentMessage>\d+)\s+(?<count>\d+)"
  | fields + sentMessage count | fields - _time|bin sentMessage span=10|chart sum(count) as total by sentMessage

https://docs.splunk.com/Documentation/Splunk/7.2.4/Viz/ChartDisplayissues#Category_limit
This talks about the axis display issues a little bit, so without bin, if you were to zoom in, you can see the labels.

View solution in original post

cmerriman
Super Champion

I think there are just too many data points for it to show up on the axis. if you bin, they'll show up.

| makemv delim=";" data
  | mvexpand data
  | rex field=data "(?<sentMessage>\d+)\s+(?<count>\d+)"
  | fields + sentMessage count | fields - _time|bin sentMessage span=10|chart sum(count) as total by sentMessage

https://docs.splunk.com/Documentation/Splunk/7.2.4/Viz/ChartDisplayissues#Category_limit
This talks about the axis display issues a little bit, so without bin, if you were to zoom in, you can see the labels.

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...