Splunk Search
Highlighted

How to force all x-axis labels to display on a timechart?

Champion

Hello.

I am trying to create a dashboard with a simple timechart showing the number of log entries per day. I am interested in the last seven days.

The problem is that the x-Axis labels only appear every other day, as do the major ticks. When I rotate the label, they appear for each day; this also happens when I reduce the number of days. I suspect this behavior is because there is (allegedly) not enough space for the label to display in horizontal mode for seven days.

From what I understand, I am not the first to come across this problem, for example:
http://answers.splunk.com/answers/62567/avoid-chart-skipping-every-other-day-label-on-x-axis.html
http://answers.splunk.com/answers/113616/x-axis-marks.html

I have tried the solution to the second problem (creating buckets for results per day and using the buckets to display in the chart), but then my results are no longer in chronological order (and somehow can't be sorted), but even if that worked this is not a pretty solution. What I am looking for is a way to force the display of a label for each day, even if they overlap (which wouln't even happen in my case).

Things I have tried are setting the visibility of major ticks and labels:

<option name="charting.axisLabelsX.majorLabelVisibility">show</option>
<option name="charting.axisLabelsX.majorTickVisibility">show</option> 

I also tried to set the major unit with

<option name="charting.axisLabelsX.majorUnit"> P1M1D</option>

but that has no effect whatsoever. The value P1M1D is a guess based on an answer to a similar question, because the Documentation at http://docs.splunk.com/Documentation/Splunk/6.2.2/Viz/ChartConfigurationReference does not really help with it to be honest.

So is there something I am missing, or is this simply not possible? I would be very thankful for any ideas or hints.

Cheers

Highlighted

Re: How to force all x-axis labels to display on a timechart?

Builder

Have you tried using the GUI options to display the axis labels?

0 Karma
Highlighted

Re: How to force all x-axis labels to display on a timechart?

Champion

If you're referring to the options the web editor offers, those for the x-Axis don't allow anything other than setting a title, truncating and rotating the label (the latter of which works, but which I would prefer to avoid). If you were referring to any other settings, could you please be more precise where to find them? I am still very new to this environment. Thanks!

0 Karma
Highlighted

Re: How to force all x-axis labels to display on a timechart?

SplunkTrust
SplunkTrust

As you can see here: http://docs.splunk.com/Documentation/Splunk/6.2.3/AdvancedDev/CustomChartingConfig-AxisGrid#Time_axi... setting charting.axisLabelsX.majorUnit for time-based axis labels is not compatible with JS Charts, only with Flash Charts... which are deprecated for SimpleXML.

You can somewhat cheat Splunk into giving you all labels, but then you lose a lot of features of the default timechart rendering:

index=_internal | timechart span=1m count | fields - _span | fieldformat _time = strftime(_time, "%H:%M")

alt text

Features lost include time-specific automatics drilldowns, automatic adaption of labels to bucket span, automatic adaption of labels to chart width, listing the full date once for reference, and maybe more.

0 Karma
Highlighted

Re: How to force all x-axis labels to display on a timechart?

Champion

That's a shame. Is there a reason for that? I would expect this annoys quite a few people, as one week seems a common timeframe, and I've noticed it on every timechart that has as least one neighboring element in the same row at a standard resolution.

0 Karma
Highlighted

Re: How to force all x-axis labels to display on a timechart?

Splunk Employee
Splunk Employee

It's a bit difficult to tell exactly what's going to work for you, because while you've described your endgame, you haven't really described what the counts are. Basically, timechart is a composite command. Because of that, it's got lots of settings you can apply but it also is intended to maintain a certain kind of visualization and thereby has some failsafes built in. So rather than working around it, you can either open the flood gates:

this produces the 'missing labels' you describe:

index=_internal  earliest=-7d@d latest=now| timechart span=1d count

The examples below, do not... they produce 7 series, with seven labels on the x-axis

index=_internal  earliest=-7d@d latest=now| timechart span=1d count limit=0

or you can take control yourself:

index=_internal earliest=-7d@d latest=now sourcetype=splunkd_access|bucket _time span=1d|chart count by _time| eval _time = strftime(_time, "%c")

The reason you're not seeing all the "ticks" is because timechart has a certain number of bins it produces (slices of time within the span) and it's all based on what fits. you can specify the number of bins and what's going to actually fit visually... here I've manage to solve it without messing with the bins (which would be in the second pipe above or just part of the timechart if you've gone in that direction).

If these searches don't offer insight... then perhaps you can give us some info on the counts per series so we can replicate it.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
Highlighted

Re: How to force all x-axis labels to display on a timechart?

Champion

The timechart for the first and second search look exactly alike for me, they are missing each other label. They both have seven bins with data. See here: alt text

The third variant (using a regular chart and creating the buckets manually) works ok for me axis-label wise, but they don't show empty bins - so for example my weekends where no data is collected are simply left out. I figure I can influence this behavior with XML as soon as the chart is on a dashboard, or I could fiddle around some more and make sure that empty days are filled with a zero. At any rate, it surprises me that the chart does what I want (so technically it's possible) while timechart doesn't.

0 Karma
Highlighted

Re: How to force all x-axis labels to display on a timechart?

SplunkTrust
SplunkTrust

My timechart with the post-processing will give you all the labels using a custom time format including zero-value buckets, so there's no real need to muck about with bucket|chart here. If you really wanted to, makecontinuous should give you at least the zero-value buckets in the middle... getting them at the start or end of the time range would be a lot more work that timechart already does for you.

The missing labels in your screenshot are caused by the graph display running on "timechart-autopilot", making sure the x-axis is not crowded up by labels. Reduce your time range to seven days rather than eight and you will see every bar labelled.

0 Karma
Highlighted

Re: How to force all x-axis labels to display on a timechart?

Splunk Employee
Splunk Employee

Agreed...

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma
Highlighted

Re: How to force all x-axis labels to display on a timechart?

Champion

Oh. You just made me realize that there are eight buckets... "Last seven days" apparently includes the day seven days ago, contrary to my intuition. Sorry for that...

Still, I would like to be able to influence how the axis labels are displayed, i.e. force the labels to show even if that makes the axis crowded (which, to be honest, I absolutely don't see happening in the above screenshot if every other label were to appear). "timechart-autopilot" is generally a good idea, but it's only half as useful if I haven't got any control over its output.

0 Karma