Splunk Search

How to change timechart default Y axis default scale?

wangkevin1029
Communicator

Hi,Splunkers,

 

I  have a timechart,  which have value for count by VQ  less than 10,  but default y axis scale is 100, which causes I can't see any column in my timechart.  

how to change the y Axis scale to adjust automatically to my maximum value,  

for example, if max value is less than 10,  than default scale should be 10.

 

wangkevin1029_0-1671379065026.png

 

 

thx in advance.

kevin

 

Labels (1)
0 Karma

wangkevin1029
Communicator

thx,  it looks a little complicated for me.

still not sure why my other timechart works as expected.

I will do more research.

 

thank you very much.

 

 

Kevin

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@wangkevin1029 - You can use the max value in the line chart on Y-Axis.

VatsalJagani_0-1671384776020.png

 

Consider upvoting if this helps!!!

0 Karma

wangkevin1029
Communicator

wangkevin1029_0-1671385588541.png this is working one.

 

wangkevin1029_1-1671385659275.png

 

this is not working one,  total aggragation result is 22,  max value is 100, which I didn't configure it.  

 

 

0 Karma

wangkevin1029
Communicator

Vatsal, 

 

thx for your quick response.

My splunk ver doesn't have this configuration.

however I don't want a fixed max value.  I need an automatic adjust max value here.

and  it works in my other splunk,  I  compared all visualization configuration, they are same.

not sure why other one works.

for the working one,  if the largest value is 7, then  max scale is 10,  if the largest value is 7500, then max scale is 10000.

 

Kevin 

0 Karma

wangkevin1029
Communicator

sorry, i have that max value,  but I don't want a fixed max value.

 

Kevin

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@wangkevin1029 - Then you probably can try doing it under XML by setting it as a token and dynamically generating the token value as the max value.

 

some reference:

 

        <search>
          <query>...</query>
          ...
          <done>
            <set token="tkn_max_value">$result.max_value$</set>
          </done>
        </search>

 

* Option for max value: "charting.axisX.maximumNumber"

 

<chart>
  <search> ... ..
  ...
  <option name="charting.axisX.maximumNumber">$tkn_max_value$</option>
</chart>

 

* See more references - in Splunk's Simple XML reference document.

PS: I have personally not tried with chart configuration parameter but the token works with table options.

 

I hope this helps!!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...