Splunk Search

How to show the very first tickmark in a line chart?

bojanisch
Path Finder

Hi Splunkies,

I'm plotting some sensor values together with the sensor's limit on a line chart in order to visualize values that are out of bounds. The sensor values going from negative to positive values and for the upper limit there is no problem. However regarding the lower limit the y-axis tickmarks are not shown below. I think that is due to the fact that the charting.axisLabelsY.extendsAxisRange parameter works only on positive values the right way.

Does someone have a solution how to show the next tickmark below the lower boundary so that the tickmarks cover all my positive and negative values and their boundaries?

Kind regards and thanks in advice,
Bojan

[Added]
In the example picture below the problem is shown. As you can see there is no tickmark below my lower boundary. alt text

Tags (3)
0 Karma
1 Solution

niketn
Legend

Following is an example with negative tick at -2000 (following is the updated run anywhere search query):

           <query>| gentimes start="09/01/2017"  end="09/06/2017"
 | fields starttime
 | rename starttime as _time
 | eval Value=case(strftime(_time,"%Y-%m-%d")=="2017-09-02",-1000,strftime(_time,"%Y-%m-%d")=="2017-09-04",4000)
 | eval "Limit (high)"=800
 | eval "Limit (low)"=-800</query>

alt text

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

Following is an example with negative tick at -2000 (following is the updated run anywhere search query):

           <query>| gentimes start="09/01/2017"  end="09/06/2017"
 | fields starttime
 | rename starttime as _time
 | eval Value=case(strftime(_time,"%Y-%m-%d")=="2017-09-02",-1000,strftime(_time,"%Y-%m-%d")=="2017-09-04",4000)
 | eval "Limit (high)"=800
 | eval "Limit (low)"=-800</query>

alt text

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

bojanisch
Path Finder

Hi @niketnilay,
thanks for your solution. I see that - depening on the size - I sometimes get the lowest tickmark and sometimes not. So Splunk does calculate the tick below the lower border. Is there a way to enforce it regardless of the chart size?

0 Karma

niketn
Legend

For that you need to know the limit of minimum and mximum possible values and adjust height accordingly. You can hard code min/max and intervals through UI Edit Settings for the visualization.

Even if tick marks are not displays Splunk dynamically adjusts number of y-axis labels to be displayed. For example If there were data points between -2000 to 7000 and you had intervals of 100 all the y-axis labels would not have been displayed or else text would overlap.

charting.axisLabelsY.majorLabelVisibility Simple XML chart configuration has been deprecated.
https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@bojanisch, can you add a screenshot of what is not working and what is required?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@bojanisch, since positive Y-axis shows up marking till 7500 and negative Y-axis is within 0 to -2500, the tickmarks do not show up. Try increasing the height of the Line chart and you should also be able to see negative tick marks

<option name="height">640</option>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

bojanisch
Path Finder

@niketnilay, I don't know if this option is supposed to show hidden tickmarks, but in this case it just changes the scale of the panel and adds no more information to it. Can you show me how you implemented the solution? Maybe I'm missing another parameter?

Just to confirm the problem: I have a two border sensor range and want tickmarks above the highest and below the lowest, while there are positive and negative values. Up until now I've just finished this for positive values with the charting.axisLabelsY.extendsAxisRange option but it does not work for negative values.

0 Karma

niketn
Legend

Following is a run anywhere dashboard with a dummy query to mock two limits and and two values (one positive and another negative)

alt text

<dashboard>
  <label>Timechart with negative tick marks</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>| gentimes start="09/01/2017"  end="09/06/2017"
| fields starttime
| rename starttime as _time
| eval Value=case(strftime(_time,"%Y-%m-%d")=="2017-09-02",-1000,strftime(_time,"%Y-%m-%d")=="2017-09-04",4000)
| eval "Limit (high)"=800
| eval "Limit (low)"=-800</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="height">640</option>
      </chart>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

bojanisch
Path Finder

@niketnilay in your solution and in the appended image, I see no tickmark below your lower limit. So I assume that you encountered the same issue without realizing it.

What I'm facing is that there is no tickmark below my lower border. The range extension works only for positive values and direction, not for the opposite.

So do you may have an idea how to see the next tickmark below my lowest data point (even if it's the border line)?

0 Karma

niketn
Legend

@bojanisch, just change from -1000 to -2000, and you should see the desired results. I had attached the screenshot to show that more tick marks you need more the height might need to be increased or else the visualization with ll dynamically adjust the labels on y-axis.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...