Splunk Search

How do you specify an x axis interval on a non time based line chart?

jmoral03
New Member

I've created a chart using the search: base search | chart values(y) over x

It charts perfectly except for the fact that there isn't an interval for the x axis, and I haven't been able to find a way to edit in an interval through UI options or XML editing.

Is it even possible to have intervals on the x axis if it's not time based? And if it's possible how?

0 Karma

adonio
Ultra Champion

hello there,

try the dashboard below anywhere and use the dropdown "Number of Buckets" to change interval on x axis:

<form>
  <label>Bin the X Axis</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="BUCKETS" searchWhenChanged="true">
      <label>Number of Buckets</label>
      <choice value="10">10</choice>
      <choice value="20">20</choice>
      <choice value="30">30</choice>
      <choice value="40">40</choice>
      <default>10</default>
      <initialValue>10</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Check Interval Change on X</title>
      <chart>
        <search>
          <query>| makeresults count=300
| eval x_axis = random()%200
| eval y_axis = random()%5
| eval values_for_y = case(y_axis==0,"splunk",y_axis==1,"ES",y_axis==2,"Phantom",y_axis==3,"VictorOps",1==1,"ITSI")
| bin x_axis span=$BUCKETS$ as x
| chart count(values_for_y) as y by x</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>Binning and Placing Values</title>
      <table>
        <search>
          <query>| makeresults count=30
| eval x_axis = random()%20
| eval y_axis = random()%5
| eval values_for_y = case(y_axis==0,"splunk",y_axis==1,"ES",y_axis==2,"Phantom",y_axis==3,"VictorOps",1==1,"ITSI")
| bin x_axis bins=40 as x
| chart values(values_for_y) as y over x_axis by x useother=false</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">50</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

screenshot:
alt text

0 Karma

charlottelotze
New Member

I had the same problem and solved it using span as for the timechart command.
Good luck 🙂

0 Karma

adonio
Ultra Champion

looks like @jmoral03 asked regarding intervals where the x axis is not time based.
see my answer using the bin command

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...