I'm trying to make a column chart where I want to display the values with the K notation when the number is greater than 1000 please.
Basically, I have a query that returns a table with two columns : month and number of events.
I've figured out how to create a column with the K notation by doing this :
... | timechart span=1mon count | eval k = round(count/1000, 1) | eval k_final = tostring(k)."K" | rename k_final as "Dossiers terminés" | fields - _span k k_final | table mois_fr "Dossiers terminés" k_final
The problem is that it is not possible to create a chart from string values...
Has anybody got a solution please ?
Thanks in advance
The solution is to remove the "K" from the field. Add "(K)" to the axis label of your chart so users understand numbers are in thousands.
As an aside, there is no need to include k_final in the fields command as that field no longer exists because it was renamed. For the same reason, you also can remove 'k_final' from the table command.
View solution in original post
@sprayer122 if you are on Splunk 7.0.0 or higher you can use Simple XML Chart configuration reference to convert axis labels to actual to abbreviations using K format.
charting.axisX.abbreviation : (none | auto)
PS: Enables the abbreviations of large X, Y, and Y2 numerical values with the closest SI prefix, default value is none
charting.axisY2.abbreviation is not supported for scatter and bubble charts.