Splunk Search

How to change the scale of the distinct count of a field on a timechart?

RVDowning
Contributor

I have the following line:

timechart span=1d sum(TypeAErrors) , sum(TypeBErrors), dc(racf) as "Unique Ids"

but the dc(racf) is much larger than the other items displayed on the graph. I would ideally like dc(racf) / 10 so that it will scale more appropriately on the Y axis compared to the other two displayed items. But, I can't find any syntax that allows me to do this. Any ideas?

Tags (3)
1 Solution

wpreston
Motivator

You can also try this:

timechart span=1d sum(TypeAErrors) , sum(TypeBErrors), dc(eval(racf / 10)) as "Unique Ids"

View solution in original post

wpreston
Motivator

You can also try this:

timechart span=1d sum(TypeAErrors) , sum(TypeBErrors), dc(eval(racf / 10)) as "Unique Ids"

RVDowning
Contributor

That just gives me zeroes for dc(eval(racf / 10)). A "racf" is an alphanumeric ID. It is the count of these unique ids that I would like to divide by 10.

0 Karma

wpreston
Motivator

Yep, I realized that just a minute after I posted it, sorry about that (I blame a lack of caffine :-). The new search I posted should work exactly like you want.

0 Karma

RVDowning
Contributor

Yep, it works fine. Thanks much. I'm on my first cup of caffeine too. 😉

0 Karma

wpreston
Motivator

Oops, not qutie what I meant! Try this instead:

timechart span=1d sum(TypeAErrors) , sum(TypeBErrors), dc(racf) as TempVal | eval TempVal=TempVal/10 | rename TempVal as "Unique IDs"
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi RVDowning,

in the UI visualization tab, click on Format and select Y-Axis. There you can set the Scale to Log instead Linear.
Maybe this fits your needs.

cheers, MuS

0 Karma

RVDowning
Contributor

Thanks for the suggestion, but the end user would totally freak. 🙂 But they could follow a simple division by 10, so when the mouseover showed 26.2 they would know it was 262.

0 Karma

MuS
SplunkTrust
SplunkTrust

HeHe, sounds like do not trust any statistics, you did not fake yourself

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...