Splunk Search

Column Chart: Why are small data points on a stacked column chart not displaying on some machines?

jimrobson
Explorer

I have a stacked column chart that shows 2 values in each column. One of these values tends to be very small (0-3 events). It works fine on my machine; I can see a thin line at the bottom of each column where this value is greater than 0. However, on some other users' machines, the value is not visible at all. If they hover the mouse cursor over it, the tooltip shows, and they can click to drill down.

What can I do to make the small value display across different machines?

Sample environment where it's not working:
Windows 7 Enterprise SP1
IE: 11.0.9600.18376
Chrome: 45.0.2454.101 m
Firefox: 34.0.5

Runals
Motivator

When you've looked at the data is the line not there because the machines in question didn't create the event or the event value was 0? if it was 0 I'd expect to see the line - if it isn't there I'd guess the data isn't there. A potential is to use the fillnull command if it is the same field every time. Alternatively if there are several possible fields I'd maybe do some sort of foreach.

index=foo | foreach value1 value2 value3 [ eval <<FIELD>> = coalesce(<<FIELD>>, 0) ] 

Perhaps if you showed some sample data it would help. At any rate I'm wondering if the issue is the data not being there vs some sort of browser display issue.

0 Karma

jimrobson
Explorer

Runals - thank you for the response.

The data is there on their machines. If they place a mouse cursor over a column where the value is greater than 0, the tooltip displays showing the number of events. (I was going to add a screen shot, but don't have enough Karma points.) They can click to drill down and see the actual logs.

0 Karma

Runals
Motivator

Ahh I read your message wrong. Other than using the Y axis I've never looked at showing a value in the bar itself. I'm not sure that is an out of the box option - I could well be wrong in that regard though.

0 Karma

jimrobson
Explorer

I'm not trying to show a value in the column.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Observability Simplified: Combining User Experience, Application Performance & ...

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network ...

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...