Splunk Search

How to modify x-axis labels to show bin centers?

rtakatsuka
Engager

I am trying to create a histogram plot, but I want to make the x-axis labels more readable. How do I go about doing this?

Here is what I am doing:

my search | bin field span 0.5 | chart count by field

Here is an example of the x-axis when create the chart. Is there a way to force the x-axis to show single values for each bin (at the bin center)? Or even better, can I force the x-axis to place integer labels at their respective positions relative to my bins?

alt text

Labels (3)

niketn
Legend

@rtakatsuka Please try the following:

my search 
| bin field span 0.5 
| chart count by field
| eval field=replace(field,"^([^-]+)-(.*)","\1")

This will retain the first part of the bin (before hyphen). If you need the second part of bin after hyphen, use \2 instead of \1 i.e. | eval field=replace(field,"^([^-]+)-(.*)","\2")

Following is a run anywhere example with cooked up sample data, based on the question:

| makeresults count=10 
| eval field=random(), field=substr(field,1,1), count=random(), count=substr(count,3) 
| bin field span=0.5
| chart sum(count) as count by field
| eval field=replace(field,"^([^-]+)-(.*)","\1")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Splunknewbuiee
Engager

This works for positive numbers, but what about negative numbers? do we need to have some conditions for this case? 

0 Karma
Get Updates on the Splunk Community!

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...