Splunk Search

How to modify x-axis labels to show bin centers?


I am trying to create a histogram plot, but I want to make the x-axis labels more readable. How do I go about doing this?

Here is what I am doing:

my search | bin field span 0.5 | chart count by field

Here is an example of the x-axis when create the chart. Is there a way to force the x-axis to show single values for each bin (at the bin center)? Or even better, can I force the x-axis to place integer labels at their respective positions relative to my bins?

alt text

Labels (3)


@rtakatsuka Please try the following:

my search 
| bin field span 0.5 
| chart count by field
| eval field=replace(field,"^([^-]+)-(.*)","\1")

This will retain the first part of the bin (before hyphen). If you need the second part of bin after hyphen, use \2 instead of \1 i.e. | eval field=replace(field,"^([^-]+)-(.*)","\2")

Following is a run anywhere example with cooked up sample data, based on the question:

| makeresults count=10 
| eval field=random(), field=substr(field,1,1), count=random(), count=substr(count,3) 
| bin field span=0.5
| chart sum(count) as count by field
| eval field=replace(field,"^([^-]+)-(.*)","\1")
| makeresults | eval message= "Happy Splunking!!!"


This works for positive numbers, but what about negative numbers? do we need to have some conditions for this case? 

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...