Above Link (https://answers.splunk.com/answers/52850/plotting-text-values-on-y-axis.html) does not work for me. Has this question ever been answered?
I am also looking for a way to show words (enumerations) on the Y-axis ticks. Such as state descriptors "-1=unknown, 0=off, 1=reduced_mode, 2=on" etc.
possible similar q here
https://answers.splunk.com/answers/52850/plotting-text-values-on-y-axis.html
I am on version 6.3
Lets say this is your search:
... | timechart max(onOff)
You can change this to:
... | eval onOff=if(onOff=10,"on","off") | timechart list(onOff)
or even:
... | eval onOff=if(onOff=10,"on","off") | chart onOff by _time
tks that works in a table format as per below(nothing show in the visualisation tab), but I want the 10 on the y-axis to be on and 0 to be off (or vice versa). This way it would be more clear in a graph as opposed to the table format below
... | rename l_max_x as onOff | eval onOff=if(onOff=10,"on","off") | timechart span=h list(onOff)
gives:
_time list(onOff)
101 2016-06-18 13:00 off
102 2016-06-18 14:00 off
103 2016-06-18 15:00 off
104 2016-06-18 16:00 off
105 2016-06-18 17:00 on
106 2016-06-18 18:00 on
107 2016-06-18 19:00 on
108 2016-06-18 20:00 on
109 2016-06-18 21:00 on
110 2016-06-18 22:00 on
111 2016-06-18 23:00 on
...| rename l_max_x as onOff | eval onOff=if(onOff=10,"on","off") | timechart list(onOff)
gives:
7 2016-06-20
on
on
on
on
on
on
on
off
off
off
off
off
off
off
off
off
off
on
on
on
on
on
on
on
8 2016-06-21
on
on
on
on
on
on
on
off
off
off
... | rename l_max_x as onOff | eval onOff=if(onOff=10,"on","off") | chart values(onOff) by _time
gives:
_time values(onOff)
101 2016-06-18 13:00 off
102 2016-06-18 14:00 off
103 2016-06-18 15:00 off
104 2016-06-18 16:00 off
105 2016-06-18 17:00 on
106 2016-06-18 18:00 on
107 2016-06-18 19:00 on
108 2016-06-18 20:00 on