Splunk Search

How to display all values in the y axis and not show others in the legends for the y axis in splunk dashboard panel?

varsh_6_8_6
Explorer

Hi
I am kinda stuck and need help. I am creating a chart in the splunk dashboard and for the y axis I have nearly 20 values which are to be shown as legends. After a certain number of values they are grouped as "other" which dont want and need to display as separate ones. Also I am also ready to turn off the legend.

varsh_6_8_6_0-1730128184786.png


The query used is 

index = "xyz"
|rex field=group "<Instance>(?<instance>[^<]+)</Instance>"
|rex field=group "<SESSIONS>(?<sessions>\d+)</SESSIONS>"
| chart values(sessions) BY _time, instance



May I know which option in the chart will not collapse the values of the y axis?

Labels (1)
Tags (2)

prateek
Engager

This is very helpful

richgalloway
SplunkTrust
SplunkTrust

Try the limit option to the chart command.

index = "xyz"
|rex field=group "<Instance>(?<instance>[^<]+)</Instance>"
|rex field=group "<SESSIONS>(?<sessions>\d+)</SESSIONS>"
| chart limit=20 values(sessions) BY _time, instance

 or

index = "xyz"
|rex field=group "<Instance>(?<instance>[^<]+)</Instance>"
|rex field=group "<SESSIONS>(?<sessions>\d+)</SESSIONS>"
| chart limit=0 values(sessions) BY _time, instance
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...