I have 90 days data and i want to display in column chart. i am getting all the data but x axis label is missing. how to fix it

[DataOrg]

X axis label is missing. if i reduce the no of data i am getting label. how to accommodate all data with x axis label

[niketn · Accepted solution]

@premranjithj, try rotating the axis label by 90 degrees.

<option name="charting.axisLabelsX.majorLabelStyle.rotation">90</option>

https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference

You can also see having only one panel per row, that will accommodate more data points in the chart. How many data points do you have? Is it one per day? You can format time on X-axis for display in shorter format using fieldformat command. For example:

| fieldformat _time=strftime(_time,"%m-%d")

[DataOrg]

its one per day. i am not able to plot still after changing to 90

[niketn]

You can perform | head 60 or | head 50 to see how many labels can be displayed in x-axis as per your display area width. While 90 did not work for me 60 did.

If x-axis is _time epoch field, and you are using timechart command to plot your series then x-axis will adjust time labels to be displayed. You can also check out Punchcard visualization to see if it fits depicting the visualization as you require.

[DataOrg]

head 60 or head 50 will work.. is there any possibility to display all the values

[niketn]

I think with Column chart one of the options is to reduce browser display size to less than 100% so that available width for the chart increases. Can you check out Puchcard Custom Visualization whether it fits the need? Punchcard can display more labels in x-axis however it may overlap values.

[niketn]

Can you share at least the final pipe for generating stats for display?

[DataOrg]

|stats sum(INcome) sum(spending) max(remaining) by TS.
i use remaining as overlay

[niketn]

What is TS? can you add some sample values for TS

[DataOrg]

TS is date value

[niketn]

Is it date in string format or epoch format? The reason why I ask is if you switch to timechart instead of stats, then x-axis will adjust on its own.

For example:

| eval TS=strptime(TS,"%Y/%m/%d")
| eval _time=TS
| timechart span=1d sum(INcome) as Income sum(spending) as Expense max(remaining) as Saving

PS: eval with strptime() will not be required if TS is epoch time. This eval is required only if TS is string time.

[niketn]

@premranjithj, I am converting my comments to answer. If these comments have helped, please accept to mark this question as answered.