How to remove white space to the right of the time chart?

[wills2g]

Hi All,

When using the line chart visualisation with a timechart command, there is additional white space to the right (later times) of the right most value on the x axis. Is there any way to make the line chart end on the final date in the data rather than extend more to the right (where there is no data)?

Cheers.

[niketn]

@wills2g have you tried cont=for else used stats command with bin so that it shows only data points where values are present?

<yourBaseSearch>
| timechart span=1d count cont=f

Or

<yourBaseSearch>
| bin _time span=1d
| stats count by _time

Other round-about option would be to takeout time buckets with 0 count i.e.

<yourBaseSearch>
| timechart span=1d count
| fillnull value=0 count
| search count!=0

Final option (still roundabout) would be to get the max _timestamp where data is present and filter out _time > maxTime.

[renjith_nair · Accepted solution]

Hi @wills2g,

Either you could reduce the time range to fit your timechart to display only available data or you could use fixedrange=false (Specify whether or not to enforce the earliest and latest times of the search. Setting fixedrange=false allows the timechart command to constrict to just the time range with valid data. )

http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Timechart#Optional_arguments

[wills2g]

Thanks for the reply. The primary issue is that the x-axis is getting extended beyond the latest time/value pair so that to the right of the last data point, it's just blank space.

For example, http://docs.splunk.com/File:7.1.0_timechartViews-compressor.png, the visualisation extends past where the data ends.

[renjith_nair]

okie, did you try fixedrange=false in your timechart and does it work?

[wills2g]

Yeah, I tried that but it still extends the values past the final x-axis value. Would you have any other ideas?

[renjith_nair]

you could also use cont as mentioned in http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Timechart#Optional_arguments but this will omit the '0' valued fields. Do you have a sample spl to try that?