Splunk Search

How to change timechart default Y axis default scale?

wangkevin1029
Communicator

Hi,Splunkers,

 

I  have a timechart,  which have value for count by VQ  less than 10,  but default y axis scale is 100, which causes I can't see any column in my timechart.  

how to change the y Axis scale to adjust automatically to my maximum value,  

for example, if max value is less than 10,  than default scale should be 10.

 

wangkevin1029_0-1671379065026.png

 

 

thx in advance.

kevin

 

Labels (1)
0 Karma

wangkevin1029
Communicator

thx,  it looks a little complicated for me.

still not sure why my other timechart works as expected.

I will do more research.

 

thank you very much.

 

 

Kevin

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@wangkevin1029 - You can use the max value in the line chart on Y-Axis.

VatsalJagani_0-1671384776020.png

 

Consider upvoting if this helps!!!

0 Karma

wangkevin1029
Communicator

wangkevin1029_0-1671385588541.png this is working one.

 

wangkevin1029_1-1671385659275.png

 

this is not working one,  total aggragation result is 22,  max value is 100, which I didn't configure it.  

 

 

0 Karma

wangkevin1029
Communicator

Vatsal, 

 

thx for your quick response.

My splunk ver doesn't have this configuration.

however I don't want a fixed max value.  I need an automatic adjust max value here.

and  it works in my other splunk,  I  compared all visualization configuration, they are same.

not sure why other one works.

for the working one,  if the largest value is 7, then  max scale is 10,  if the largest value is 7500, then max scale is 10000.

 

Kevin 

0 Karma

wangkevin1029
Communicator

sorry, i have that max value,  but I don't want a fixed max value.

 

Kevin

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@wangkevin1029 - Then you probably can try doing it under XML by setting it as a token and dynamically generating the token value as the max value.

 

some reference:

 

        <search>
          <query>...</query>
          ...
          <done>
            <set token="tkn_max_value">$result.max_value$</set>
          </done>
        </search>

 

* Option for max value: "charting.axisX.maximumNumber"

 

<chart>
  <search> ... ..
  ...
  <option name="charting.axisX.maximumNumber">$tkn_max_value$</option>
</chart>

 

* See more references - in Splunk's Simple XML reference document.

PS: I have personally not tried with chart configuration parameter but the token works with table options.

 

I hope this helps!!

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...