Splunk Search

Controlling chart (y axis) range

natrixia
Explorer

I am charting a range of 30 values (let's call them R) staring around 689511876 ending 690635036. The timechart report gives me a y-axis-min=0 y-axis-max=700,000,000. I want the y-axis min and max to be data dependent, i.e. y-axis-min=min(R) and the y-axis-max=max(R) is there a way to easily do this? If not, how do I get more a more reasonable y-axis range?

1 Solution

sideview
SplunkTrust
SplunkTrust

1) When you use Splunk's report builder, in the 'format report' view, there are a bunch of options that are often missed. Click 'y-axis' and you'll see textfields where you can set the minimum and maximum range of the report. When you save the report from that interface, these values will get preserved in a 'viewstate' object that's linked to the report.

2) If you dont want the extra baggage of using report builder and viewstates, and you're already comfortable editing your own views, it's quite easy to set this range directly in the view XML:

<param name="charting.secondaryAxis.minimumNumber">650000000</param>
<param name="charting.secondaryAxis.maximumNumber">700000000</param>

3) there is a charting key called "charting.chart.axisY.includeZero", and I used it on a weird prototype once to do exactly this, ie snap in snugly around the data automatically. Of course this was a long time ago, and the charting reference also says that the default is 'false' (which doesnt really match observed behavior), so I could be misremembering.

http://www.splunk.com/base/Documentation/latest/Developer/CustomChartingConfig-AxisGrid

but give it a shot cause it might do what you want:

<param name="charting.chart.axisY.includeZero">False</param>

NOTE: these <param> tags are in the advanced XML syntax, intended to be put inside HiddenChartFormatter module. If you're using the simplified XML, you use slightly different syntax but you can probably figure that out.

View solution in original post

stanwin
Contributor

for simple XML it should be

< option name="charting.axisY.minimumNumber">0

< option name="charting.axisY.maximumNumber">15

NOT secondaryAxis but axisY

mic
Splunk Employee
Splunk Employee

This feature "includeZero=false" was indeed broken, and now it seems to be fixed. However, there is a twist to this. Setting charting.chart.axisY.includeZero will have no effect, and the correct property is now charting.axisY.includeZero

In other words, instead of using <param name="charting.chart.axisY.includeZero">False</param>

Now, you need to use <param name="charting.axisY.includeZero">False</param>

With this fix, our charts can look prettier than ever before.

sk314
Builder

this is a really cool tip.

0 Karma

natrixia
Explorer

The minimumNumber/maximumNumber work but includeZero=false is broken (at least using 'option' via the SimpleXML). This seems to be a bug, where should I file the report?

0 Karma

sideview
SplunkTrust
SplunkTrust

You can email support@splunk.com with any bug. Cause this is kind of an obscure key, include all the details you can to help them reproduce and investigate.

NOTE: by the way comments like this should always be actual comments on answers or on questions, rather than being entered in the form of an alternate answer. The 'add new comment' link is a little hard to see in the new design, but things work better that way. Feel free to add yr 'answer' as a comment and I'll move my comment over likewise.

0 Karma

sideview
SplunkTrust
SplunkTrust

1) When you use Splunk's report builder, in the 'format report' view, there are a bunch of options that are often missed. Click 'y-axis' and you'll see textfields where you can set the minimum and maximum range of the report. When you save the report from that interface, these values will get preserved in a 'viewstate' object that's linked to the report.

2) If you dont want the extra baggage of using report builder and viewstates, and you're already comfortable editing your own views, it's quite easy to set this range directly in the view XML:

<param name="charting.secondaryAxis.minimumNumber">650000000</param>
<param name="charting.secondaryAxis.maximumNumber">700000000</param>

3) there is a charting key called "charting.chart.axisY.includeZero", and I used it on a weird prototype once to do exactly this, ie snap in snugly around the data automatically. Of course this was a long time ago, and the charting reference also says that the default is 'false' (which doesnt really match observed behavior), so I could be misremembering.

http://www.splunk.com/base/Documentation/latest/Developer/CustomChartingConfig-AxisGrid

but give it a shot cause it might do what you want:

<param name="charting.chart.axisY.includeZero">False</param>

NOTE: these <param> tags are in the advanced XML syntax, intended to be put inside HiddenChartFormatter module. If you're using the simplified XML, you use slightly different syntax but you can probably figure that out.

sideview
SplunkTrust
SplunkTrust

It's the same except simple xml uses <option> for these keys instead of <param>.

So:

<option name="charting.secondaryAxis.minimumNumber">650000000</option>
<option name="charting.secondaryAxis.maximumNumber">700000000</option>

and

<option name="charting.chart.axisY.includeZero">False</option>

http://docs.splunk.com/Documentation/Splunk/6.0/Viz/PanelreferenceforSimplifiedXML#Panel_visualizati...

0 Karma

travis_bear
Explorer

I would be happy to see an example of doing this in the simplified XML syntax.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...