Dashboards & Visualizations

Is there a way to show or display all legend label in bar chart?

matoulas
Path Finder

Hi,

Is there a way to show or display all legend label in bar chart? Per my screenshot It's only display up to 9 items on the legend label. I would like to display them all on the legend label.

alt text

Tags (1)
0 Karma

vwilson3
Path Finder

Thanks, jpolvino!  That worked for my timechart!

0 Karma

akira2211
Explorer

Hi, I have the same issue. Have you find out the solution for this ? Many thanks !

Tags (1)
0 Karma

matoulas
Path Finder

Another question why all my output showing the same result for all of my plug current.alt text
It should show the difference result for all

0 Karma

matoulas
Path Finder

I've try to set limit=0 useother=f as your suggestion, but the legend label still show up to 9 items max. I've at least 16 legend label that need to display on the legend.

0 Karma

matoulas
Path Finder

Hi,

I did try to used limit=0 useother=f right after timechart but the graph still show up to 9 items. I've a total of 16 items minimum that need to be display on the legend label.

0 Karma

jpolvino
Builder

Under your series list on the right, do you see a small pager with up/down arrows? This is what Splunk visualizations use to indicate there is more than can be displayed. If you hover along the bottom of your chart just before the data table, you can stretch down to give more room for the series. I'm doing this right now and it is showing 20 series.

Try getting out of the visualization tab and look at the Statistics tab. Do all your series show there?

0 Karma

matoulas
Path Finder

Updated I got it to display all the plug now from at lest 1 digit or more

| rex mode=sed "s/plug(\d+)/plug/g"

By follow the splunk doc regular expression
https://docs.splunk.com/Documentation/Splunk/8.0.0/Knowledge/AboutSplunkregularexpressions

0 Karma

matoulas
Path Finder

If I used the below code, I still got the bar chart to display only 9 items. It's suppose to display 16 items or more on the bar chart and the legend label. Also the result were giving the wrong data for each current plug.

| search siteid=$siteid$ location=$location$
| rex mode=sed "s/plug(\d)/plug/g"
| spath output=pname path=powerdata{}.plug{}.plugname
| spath
| timechart max(powerdata{}.plug{}.current) by powerdata{}.plug{}.plugname limit=0 useother=f

0 Karma

jpolvino
Builder

Try limit=0 and useother=f in your timechart command, right after timechart for better readability.

You can then heighten your chart visualization for more real estate.

Beware that you may run into a limit if you have too many series and/or data points to plot.

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...