I am charting a range of 30 values (let's call them R) staring around 689511876 ending 690635036. The timechart report gives me a y-axis-min=0 y-axis-max=700,000,000. I want the y-axis min and max to be data dependent, i.e. y-axis-min=min(R) and the y-axis-max=max(R) is there a way to easily do this? If not, how do I get more a more reasonable y-axis range?
1) When you use Splunk's report builder, in the 'format report' view, there are a bunch of options that are often missed. Click 'y-axis' and you'll see textfields where you can set the minimum and maximum range of the report. When you save the report from that interface, these values will get preserved in a 'viewstate' object that's linked to the report.
2) If you dont want the extra baggage of using report builder and viewstates, and you're already comfortable editing your own views, it's quite easy to set this range directly in the view XML:
<param name="charting.secondaryAxis.minimumNumber">650000000</param> <param name="charting.secondaryAxis.maximumNumber">700000000</param>
3) there is a charting key called "charting.chart.axisY.includeZero", and I used it on a weird prototype once to do exactly this, ie snap in snugly around the data automatically. Of course this was a long time ago, and the charting reference also says that the default is 'false' (which doesnt really match observed behavior), so I could be misremembering.
but give it a shot cause it might do what you want:
<param> tags are in the advanced XML syntax, intended to be put inside
HiddenChartFormatter module. If you're using the simplified XML, you use slightly different syntax but you can probably figure that out.
It's the same except simple xml uses
<option> for these keys instead of
<option name="charting.secondaryAxis.minimumNumber">650000000</option> <option name="charting.secondaryAxis.maximumNumber">700000000</option>
The minimumNumber/maximumNumber work but includeZero=false is broken (at least using 'option' via the SimpleXML). This seems to be a bug, where should I file the report?
You can email firstname.lastname@example.org with any bug. Cause this is kind of an obscure key, include all the details you can to help them reproduce and investigate.
NOTE: by the way comments like this should always be actual comments on answers or on questions, rather than being entered in the form of an alternate answer. The 'add new comment' link is a little hard to see in the new design, but things work better that way. Feel free to add yr 'answer' as a comment and I'll move my comment over likewise.
This feature "includeZero=false" was indeed broken, and now it seems to be fixed. However, there is a twist to this. Setting charting.chart.axisY.includeZero will have no effect, and the correct property is now charting.axisY.includeZero
In other words, instead of using <param name="charting.chart.axisY.includeZero">False</param>
Now, you need to use <param name="charting.axisY.includeZero">False</param>
With this fix, our charts can look prettier than ever before.
for simple XML it should be
< option name="charting.axisY.minimumNumber">0
< option name="charting.axisY.maximumNumber">15
NOT secondaryAxis but axisY