Splunk Search

Is it possible to make y-axis labels display "on" and "off" instead of numerical values on my chart?

Motivator

I have the following graph:

alt text

On the y-axis, 0 is on and 10 is off. Can I label it accordingly, but still present it the same way?

So the y-axis would just have 2 labels: on and off.

Tags (4)
0 Karma

Motivator
0 Karma

SplunkTrust
SplunkTrust

Lets say this is your search:

... | timechart max(onOff)

You can change this to:

... | eval onOff=if(onOff=10,"on","off") | timechart list(onOff)

or even:

... | eval onOff=if(onOff=10,"on","off") | chart onOff by _time
0 Karma

Motivator

tks that works in a table format as per below(nothing show in the visualisation tab), but I want the 10 on the y-axis to be on and 0 to be off (or vice versa). This way it would be more clear in a graph as opposed to the table format below

... | rename l_max_x as onOff | eval onOff=if(onOff=10,"on","off") | timechart span=h list(onOff)

gives:

_time   list(onOff)
101 2016-06-18 13:00    off
102 2016-06-18 14:00    off
103 2016-06-18 15:00    off
104 2016-06-18 16:00    off
105 2016-06-18 17:00    on
106 2016-06-18 18:00    on
107 2016-06-18 19:00    on
108 2016-06-18 20:00    on
109 2016-06-18 21:00    on
110 2016-06-18 22:00    on
111 2016-06-18 23:00    on

...| rename l_max_x as onOff | eval onOff=if(onOff=10,"on","off") | timechart list(onOff)

gives:

7   2016-06-20  
on
on
on
on
on
on
on
off
off
off
off
off
off
off
off
off
off
on
on
on
on
on
on
on
8   2016-06-21  
on
on
on
on
on
on
on
off
off
off

... | rename l_max_x as onOff | eval onOff=if(onOff=10,"on","off") | chart values(onOff) by _time
gives:

_time   values(onOff)
101 2016-06-18 13:00    off
102 2016-06-18 14:00    off
103 2016-06-18 15:00    off
104 2016-06-18 16:00    off
105 2016-06-18 17:00    on
106 2016-06-18 18:00    on
107 2016-06-18 19:00    on
108 2016-06-18 20:00    on
0 Karma