Splunk Search

Column Chart: Why are small data points on a stacked column chart not displaying on some machines?

jimrobson
Explorer

I have a stacked column chart that shows 2 values in each column. One of these values tends to be very small (0-3 events). It works fine on my machine; I can see a thin line at the bottom of each column where this value is greater than 0. However, on some other users' machines, the value is not visible at all. If they hover the mouse cursor over it, the tooltip shows, and they can click to drill down.

What can I do to make the small value display across different machines?

Sample environment where it's not working:
Windows 7 Enterprise SP1
IE: 11.0.9600.18376
Chrome: 45.0.2454.101 m
Firefox: 34.0.5

Runals
Motivator

When you've looked at the data is the line not there because the machines in question didn't create the event or the event value was 0? if it was 0 I'd expect to see the line - if it isn't there I'd guess the data isn't there. A potential is to use the fillnull command if it is the same field every time. Alternatively if there are several possible fields I'd maybe do some sort of foreach.

index=foo | foreach value1 value2 value3 [ eval <<FIELD>> = coalesce(<<FIELD>>, 0) ] 

Perhaps if you showed some sample data it would help. At any rate I'm wondering if the issue is the data not being there vs some sort of browser display issue.

0 Karma

jimrobson
Explorer

Runals - thank you for the response.

The data is there on their machines. If they place a mouse cursor over a column where the value is greater than 0, the tooltip displays showing the number of events. (I was going to add a screen shot, but don't have enough Karma points.) They can click to drill down and see the actual logs.

0 Karma

Runals
Motivator

Ahh I read your message wrong. Other than using the Y axis I've never looked at showing a value in the bar itself. I'm not sure that is an out of the box option - I could well be wrong in that regard though.

0 Karma

jimrobson
Explorer

I'm not trying to show a value in the column.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Note: This post outlines a proposed architecture and serves as an interest check. If we secure commitments ...