Splunk Search

Is it possible to make y-axis labels display "on" and "off" instead of numerical values on my chart?

HattrickNZ
Motivator

I have the following graph:

alt text

On the y-axis, 0 is on and 10 is off. Can I label it accordingly, but still present it the same way?

So the y-axis would just have 2 labels: on and off.

Tags (4)
0 Karma

rikinet
Explorer

Above Link (https://answers.splunk.com/answers/52850/plotting-text-values-on-y-axis.html) does not work for me. Has this question ever been answered?

I am also looking for a way to show words (enumerations) on the Y-axis ticks. Such as state descriptors "-1=unknown, 0=off, 1=reduced_mode, 2=on" etc.

0 Karma

HattrickNZ
Motivator
0 Karma

jkat54
SplunkTrust
SplunkTrust

Lets say this is your search:

... | timechart max(onOff)

You can change this to:

... | eval onOff=if(onOff=10,"on","off") | timechart list(onOff)

or even:

... | eval onOff=if(onOff=10,"on","off") | chart onOff by _time
0 Karma

HattrickNZ
Motivator

tks that works in a table format as per below(nothing show in the visualisation tab), but I want the 10 on the y-axis to be on and 0 to be off (or vice versa). This way it would be more clear in a graph as opposed to the table format below

... | rename l_max_x as onOff | eval onOff=if(onOff=10,"on","off") | timechart span=h list(onOff)

gives:

_time   list(onOff)
101 2016-06-18 13:00    off
102 2016-06-18 14:00    off
103 2016-06-18 15:00    off
104 2016-06-18 16:00    off
105 2016-06-18 17:00    on
106 2016-06-18 18:00    on
107 2016-06-18 19:00    on
108 2016-06-18 20:00    on
109 2016-06-18 21:00    on
110 2016-06-18 22:00    on
111 2016-06-18 23:00    on

...| rename l_max_x as onOff | eval onOff=if(onOff=10,"on","off") | timechart list(onOff)

gives:

7   2016-06-20  
on
on
on
on
on
on
on
off
off
off
off
off
off
off
off
off
off
on
on
on
on
on
on
on
8   2016-06-21  
on
on
on
on
on
on
on
off
off
off

... | rename l_max_x as onOff | eval onOff=if(onOff=10,"on","off") | chart values(onOff) by _time
gives:

_time   values(onOff)
101 2016-06-18 13:00    off
102 2016-06-18 14:00    off
103 2016-06-18 15:00    off
104 2016-06-18 16:00    off
105 2016-06-18 17:00    on
106 2016-06-18 18:00    on
107 2016-06-18 19:00    on
108 2016-06-18 20:00    on
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...