Dashboards & Visualizations

dynamic span

wcleong
New Member

hi, I have a area chart as below search command

index=index_rv TAG="*" CELL_NAME=* TAG!=TAG CELL_NAME!=CELL_NAME |  eval Diff_Percentage = max(Metal_I_diff)  | eval Current = Metal_I_1 * 1 |  chart min(Diff_Percentage),max(Diff_Percentage) by Current span=0.01

however, my data range for x axis might be varied, and I would like to have the spanning to be max(Current)/1000 so that I can span it to 1000 plot only, can I know how to do it? I tried below but it is not working

index=index_rv TAG="*" CELL_NAME=* TAG!=TAG CELL_NAME!=CELL_NAME |  eval Diff_Percentage = max(Metal_I_diff)  | eval Current = Metal_I_1 * 1 |  chart min(Diff_Percentage),max(Diff_Percentage) by Current span=eval(max (Current)/10000)
Tags (2)
0 Karma

wcleong
New Member

The problem is when using bins, it will tend to not bucketise the 0 value, and cause the graph to be non linear on the x-axis.. I need to see the overall graph shape.

0 Karma

dwaddle
SplunkTrust
SplunkTrust

You might try instead of setting a specific span= to use bins= in order to tell the chart command that you want it to use (up to) a set number of bins, and let it figure out an appropriate size.

0 Karma

wcleong
New Member

The problem is when using bins, it will tend to not bucketise the 0 value, and cause the graph to be non linear on the x-axis.. I need to see the overall graph shape.

0 Karma
Get Updates on the Splunk Community!

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through: An introduction to the Splunk Threat ...