Splunk Search

How to set different charts' Y axis values to be dependent of the values of one chart ?

Hello. This is my third of fourth question in this page (I think) so I would like to beg you mercy if this issue/questions has been already dealt with.
Basically, I have 3 charts with different Y-Axis values (let's say data load in MB). The 1st is the highest load and has a max Y-axis value of around 25. The 2nd chart has low load and it's limit in Y-axis is around 0.5. The third one is around 2.5. When I compare the three charts, the line is drawn at the same level.
But what I really want is for the 3 of them to have the same Y-axis limits as the top one. Needless to say, if the Y-axis value of the top limit chart increases or decreases, all of them would change as well automatically.

I have found out that I can set manually the Y-axis min and max value but this is only temporarily. Sooner I will input more charts on the page and the limits may go as high as 200 or more. So when this happens, I would like all the charts to have the same limit as the maximum one.

Thank you for your time and your help in advance. I really hope I could find some help here.
Best,
Juan

Explorer

Hi,

You can achieve this. First, create a hidden dropdown with dynamic options. Pass your query to calculate the maximum y-axis range from this. Now the dropdown token will have that max value. Then use that token, say max_count, as folows:

<option name="charting.axisY.maximumNumber">$max_count$</option>

So, the code will look like this (intentionally removed other options for better visibility):

<fieldset submitButton="false" autoRun="true">
    <input type="dropdown" token="max_count" searchWhenChanged="true" depends="$xyz$"> //any non-existing token for depends
      <label>Count</label>
      <selectFirstChoice>true</selectFirstChoice>
      <populatingSearch earliest="0" latest="" fieldForLabel="Count" fieldForValue="Count">query</populatingSearch>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Title</title>
        <searchString>query</searchString>
        <earliestTime>$InputTime.earliest$</earliestTime>
        <latestTime>$InputTime.latest$</latestTime>
        <option name="charting.axisY.maximumNumber">$max_count$</option>
        <option name="charting.chart">column</option>
      </chart>
    </panel>
  </row>

Hope this helps !!!!

PS: Tested on Splunk 6.2+. For versions less than 6.2, hidden dropdown functionality won't work.

0 Karma

Esteemed Legend

I do not know of any way to do what you are asking (that is not the same thing as "there is not a way") but I think if you change your Y-axis scales from linear to log, you will be very pleased with that option as a work-around for what is really bothering you which, if I am not mistaken, is that you have one line that is up high and easily readable which compresses all the other lines and squishes them down on top of eachother at the bottom such that you cannot see the detail of their "wiggles". In this way, you can set the Max value to a value that is the nearest order of magnitude of the biggest value that you expect across all of your charts and each will still look very readable even when the values are small.

0 Karma

Path Finder

No, changing the y-axis from linear to log does not solve the issue. The problem is: the customer wants the same scale on two charts so he can compare the results. Hard-coding the min, max values is not an option. Scale varies wildly from week to week i.e. 80k max one week, 400 max the next week. The scale needs to dynamically change based on the max value from both charts.

0 Karma

Path Finder

I am looking for the answer to this question as well. Have you had any luck?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!