Splunk Search

Emailed PDF bar chart drops row labels if > 20 rows. How do we get the chart labels to display properly?

rgsage
Path Finder

We are on Splunk 6.2.1
Every night we have Splunk email our executive staff a PDF with a bar chart showing a measure per widget (row). They were very happy. Just recently, the number of widgets we are tracking increased to >20. And the bar chart labels have disappeared. Now the chart is useless.

I can duplicate this with a bar chart dashboard based on this Splunk search:

index=_internal earliest=@m-20m | bin _time span=1m | chart count by _time

Click Edit / Schedule PDF Delivery / Schedule PDF / Preview PDF. Observe bar chart with 21 rows and no labels.
alt text

The following search generates a <20 row bar chart with labels intact:

index=_internal earliest=@m-18m | bin _time span=1m | chart count by _time

alt text

Setting an explicit height like this:

<option name="height">500</option>

Helps guarantee the row labels appear in the browser view, but does not seem to have any impact on the PDF. Paper size/layout does not seem to have any impact either.

0 Karma
1 Solution

eryder_splunk
Splunk Employee
Splunk Employee

Engineering has rejected this as a bug and states that, "this behavior is by design due to when the number of levels increases they might collide and need to be skipped.". They also said they may reconsider this in the future and try to dynamically adjust text or surrounding white space if it's feasible/readable.

View solution in original post

0 Karma

eryder_splunk
Splunk Employee
Splunk Employee

Engineering has rejected this as a bug and states that, "this behavior is by design due to when the number of levels increases they might collide and need to be skipped.". They also said they may reconsider this in the future and try to dynamically adjust text or surrounding white space if it's feasible/readable.

0 Karma

rgsage
Path Finder

Disappointed with the resolution as there is plenty of whitespace in our PDF for row labels. But at least I know to quit tinkering with this. Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...