Splunk Search

How to display all values in the y axis and not show others in the legends for the y axis in splunk dashboard panel?

varsh_6_8_6
Explorer

Hi
I am kinda stuck and need help. I am creating a chart in the splunk dashboard and for the y axis I have nearly 20 values which are to be shown as legends. After a certain number of values they are grouped as "other" which dont want and need to display as separate ones. Also I am also ready to turn off the legend.

varsh_6_8_6_0-1730128184786.png


The query used is 

index = "xyz"
|rex field=group "<Instance>(?<instance>[^<]+)</Instance>"
|rex field=group "<SESSIONS>(?<sessions>\d+)</SESSIONS>"
| chart values(sessions) BY _time, instance



May I know which option in the chart will not collapse the values of the y axis?

Labels (1)
Tags (2)

prateek
Engager

This is very helpful

richgalloway
SplunkTrust
SplunkTrust

Try the limit option to the chart command.

index = "xyz"
|rex field=group "<Instance>(?<instance>[^<]+)</Instance>"
|rex field=group "<SESSIONS>(?<sessions>\d+)</SESSIONS>"
| chart limit=20 values(sessions) BY _time, instance

 or

index = "xyz"
|rex field=group "<Instance>(?<instance>[^<]+)</Instance>"
|rex field=group "<SESSIONS>(?<sessions>\d+)</SESSIONS>"
| chart limit=0 values(sessions) BY _time, instance
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...