How do I get the labels on the X-axis in this graph?
Ideally I would like the labels to be 0 - 129157 on the xaxis from left to right.
I think I may have to use a bin option(3/ reference below), which I may ask elsewhere but I thought I would ask this specific question first.
1/ https://answers.splunk.com/answers/584026/splunk-dashboard-timechart-x-axis-does-not-show-ho-1.html
2/ https://answers.splunk.com/answers/75828/x-axis-x-axis-dont-show-up-in-chart.html
3/ https://answers.splunk.com/answers/549858/how-to-display-numeric-x-axis-labels-on-line-chart.html
4/ https://answers.splunk.com/answers/557511/how-can-i-show-all-labels-on-x-axis-even-results-a.html
I can get the labels to appear on the xaxis with this sample search:
| makeresults
| eval data = "
1 10;
2 9;
3 8;
4 7;
5 6;
6 5;
7 4;
8 3;
9 2;
10 1;
"
| makemv delim=";" data
| mvexpand data
| rex field=data "(?<Date>\d+)\s+(?<Y>\d+)"
| fields + Date Y | fields - _time
|search Y = * |
chart count(Y) by Y | sort + Y
This is my sample search to simulate the pic above
| makeresults
| eval data = "
0 50;
1 57;
2 89;
3 196;
4 293;
5 424;
6 481;
7 518;
8 527;
9 501;
10 526;
11 452;
12 424;
13 373;
14 338;
15 301;
16 271;
17 258;
18 242;
19 217;
20 196;
21 176;
22 194;
23 180;
24 139;
25 146;
26 116;
27 143;
28 109;
29 103;
30 104;
31 117;
32 108;
33 89;
34 104;
35 86;
36 97;
37 102;
38 87;
39 81;
40 77;
41 88;
42 81;
43 68;
44 88;
45 72;
46 75;
47 88;
48 75;
49 70;
50 69;
51 59;
52 65;
53 60;
54 62;
55 62;
56 63;
57 70;
58 63;
59 51;
60 56;
61 45;
62 63;
63 62;
64 57;
65 39;
66 54;
67 48;
68 38;
69 53;
70 47;
71 51;
72 46;
73 52;
74 47;
75 48;
76 40;
77 43;
78 41;
79 36;
80 35;
81 31;
82 45;
83 41;
84 29;
85 42;
86 42;
87 39;
88 50;
89 33;
90 47;
91 42;
92 35;
93 32;
94 29;
95 48;
96 48;
97 40;
98 62;
99 46;
100 50;
101 49;
102 48;
103 59;
104 38;
105 57;
106 64;
107 65;
108 54;
109 79;
110 58;
111 76;
112 81;
113 59;
114 77;
115 80;
116 82;
117 88;
118 79;
119 101;
120 86;
121 104;
122 111;
123 93;
124 98;
125 114;
126 104;
127 123;
128 122;
129 137;
130 146;
131 131;
132 147;
133 117;
134 145;
135 165;
136 144;
137 178;
138 170;
139 169;
140 169;
141 159;
142 169;
143 177;
144 159;
145 195;
146 158;
147 193;
148 186;
149 199;
150 184;
151 181;
152 209;
153 187;
154 197;
155 196;
156 209;
157 183;
158 207;
159 214;
160 184;
161 238;
162 215;
163 194;
164 229;
165 239;
166 249;
167 216;
168 240;
169 197;
170 234;
171 237;
172 243;
173 240;
174 262;
175 255;
176 238;
177 245;
178 229;
179 224;
180 225;
181 226;
182 224;
183 244;
184 237;
185 222;
186 214;
187 189;
188 210;
189 209;
190 214;
191 216;
192 213;
193 200;
194 197;
195 199;
196 186;
197 187;
198 174;
199 163;
200 166;
201 188;
202 157;
203 170;
204 140;
205 141;
206 142;
207 143;
208 120;
209 140;
210 146;
211 119;
212 96;
213 131;
214 107;
215 111;
216 99;
217 109;
218 119;
219 95;
220 103;
221 98;
222 87;
223 79;
224 70;
225 76;
226 88;
227 79;
228 79;
229 68;
230 71;
231 64;
232 63;
233 61;
234 47;
235 59;
236 54;
237 46;
238 34;
239 41;
240 36;
241 30;
242 38;
243 27;
244 36;
245 24;
246 34;
247 23;
248 19;
249 26;
250 23;
251 21;
252 17;
253 12;
254 18;
255 15;
256 14;
257 9;
258 5;
259 9;
260 10;
261 6;
262 10;
263 10;
264 5;
265 3;
266 5;
267 6;
268 2;
269 2;
270 4;
271 1;
272 6;
273 3;
274 2;
275 2;
276 2;
277 1;
279 1;
280 1;
281 1;
282 1;
283 1;
284 1;
285 1;
286 1;
288 2;
289 1;
292 1;
295 1;
298 1;
299 1;
300 1;
304 1;
376 1;
377 1;
712 1;
942 1;
1097 1;
1299 1;
1455 1;
4978 1;
5240 1;
5979 1;
6060 1;
6432 1;
6617 1;
7168 1;
7182 1;
7211 1;
7231 1;
7253 1;
7280 1;
7285 1;
7286 1;
7331 1;
7351 1;
7356 1;
7386 1;
7444 1;
7457 1;
7465 1;
7468 1;
7592 1;
7616 1;
7620 1;
7656 1;
127017 1;
127376 1;
129157 1;
"
| makemv delim=";" data
| mvexpand data
| rex field=data "(?<sentMessage>\d+)\s+(?<count>\d+)"
| fields + sentMessage count | fields - _time
I think there are just too many data points for it to show up on the axis. if you bin, they'll show up.
| makemv delim=";" data
| mvexpand data
| rex field=data "(?<sentMessage>\d+)\s+(?<count>\d+)"
| fields + sentMessage count | fields - _time|bin sentMessage span=10|chart sum(count) as total by sentMessage
https://docs.splunk.com/Documentation/Splunk/7.2.4/Viz/ChartDisplayissues#Category_limit
This talks about the axis display issues a little bit, so without bin, if you were to zoom in, you can see the labels.
I think there are just too many data points for it to show up on the axis. if you bin, they'll show up.
| makemv delim=";" data
| mvexpand data
| rex field=data "(?<sentMessage>\d+)\s+(?<count>\d+)"
| fields + sentMessage count | fields - _time|bin sentMessage span=10|chart sum(count) as total by sentMessage
https://docs.splunk.com/Documentation/Splunk/7.2.4/Viz/ChartDisplayissues#Category_limit
This talks about the axis display issues a little bit, so without bin, if you were to zoom in, you can see the labels.