Splunk Search
Highlighted

How to suppress extra _time line on timechart in dashboard

Explorer

I have a search that creates a timechart. I do not specify a time range. When I run the search I get the results I expect.
But when I add the search to a dashboard I get a line below the time legend on the x axis that says _time. I would like to eliminate this--both the _time and the line it occupies. (That is, I don't just want to replace _time with spaces). When I go to edit visualizaton in the dashboard the x axis is blank.

Can someone help with this?

Tags (1)
Highlighted

Re: How to suppress extra _time line on timechart in dashboard

SplunkTrust
SplunkTrust

You need to set the charting.axisTitleX.visibility key to collapsed.

Using HiddenChartFormatter, it would look like this:

<module name="HiddenChartFormatter">
  <param name="charting.axisTitleX.visibility">collapsed</param>

That will not only remove the _time label, but will also collapse the vertical space it takes up.

View solution in original post

Highlighted

Re: How to suppress extra _time line on timechart in dashboard

Contributor

Unfortunately, only works with "FlashChart" and not "JSchart" module.

Highlighted

Re: How to suppress extra _time line on timechart in dashboard

Contributor

For JSChart add an empty title, like this:

For example:

    <param name="charting.chart">area</param>
    <param name="charting.axisTitleX.text"></param>
    <module name="JSChart">
Highlighted

Re: How to suppress extra _time line on timechart in dashboard

Contributor

I just found out that, strangely enough, this solution will only remove _time. If you rename _time in your query it will not remove it.

0 Karma