Splunk Search

Is it possible to make y-axis labels display "on" and "off" instead of numerical values on my chart?

HattrickNZ
Motivator

I have the following graph:

alt text

On the y-axis, 0 is on and 10 is off. Can I label it accordingly, but still present it the same way?

So the y-axis would just have 2 labels: on and off.

Tags (4)
0 Karma

rikinet
Path Finder

Above Link (https://answers.splunk.com/answers/52850/plotting-text-values-on-y-axis.html) does not work for me. Has this question ever been answered?

I am also looking for a way to show words (enumerations) on the Y-axis ticks. Such as state descriptors "-1=unknown, 0=off, 1=reduced_mode, 2=on" etc.

0 Karma

HattrickNZ
Motivator
0 Karma

jkat54
SplunkTrust
SplunkTrust

Lets say this is your search:

... | timechart max(onOff)

You can change this to:

... | eval onOff=if(onOff=10,"on","off") | timechart list(onOff)

or even:

... | eval onOff=if(onOff=10,"on","off") | chart onOff by _time
0 Karma

HattrickNZ
Motivator

tks that works in a table format as per below(nothing show in the visualisation tab), but I want the 10 on the y-axis to be on and 0 to be off (or vice versa). This way it would be more clear in a graph as opposed to the table format below

... | rename l_max_x as onOff | eval onOff=if(onOff=10,"on","off") | timechart span=h list(onOff)

gives:

_time   list(onOff)
101 2016-06-18 13:00    off
102 2016-06-18 14:00    off
103 2016-06-18 15:00    off
104 2016-06-18 16:00    off
105 2016-06-18 17:00    on
106 2016-06-18 18:00    on
107 2016-06-18 19:00    on
108 2016-06-18 20:00    on
109 2016-06-18 21:00    on
110 2016-06-18 22:00    on
111 2016-06-18 23:00    on

...| rename l_max_x as onOff | eval onOff=if(onOff=10,"on","off") | timechart list(onOff)

gives:

7   2016-06-20  
on
on
on
on
on
on
on
off
off
off
off
off
off
off
off
off
off
on
on
on
on
on
on
on
8   2016-06-21  
on
on
on
on
on
on
on
off
off
off

... | rename l_max_x as onOff | eval onOff=if(onOff=10,"on","off") | chart values(onOff) by _time
gives:

_time   values(onOff)
101 2016-06-18 13:00    off
102 2016-06-18 14:00    off
103 2016-06-18 15:00    off
104 2016-06-18 16:00    off
105 2016-06-18 17:00    on
106 2016-06-18 18:00    on
107 2016-06-18 19:00    on
108 2016-06-18 20:00    on
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...