Splunk Search

How to modify x-axis labels to show bin centers?

rtakatsuka
Engager

I am trying to create a histogram plot, but I want to make the x-axis labels more readable. How do I go about doing this?

Here is what I am doing:

my search | bin field span 0.5 | chart count by field

Here is an example of the x-axis when create the chart. Is there a way to force the x-axis to show single values for each bin (at the bin center)? Or even better, can I force the x-axis to place integer labels at their respective positions relative to my bins?

alt text

Labels (3)

niketn
Legend

@rtakatsuka Please try the following:

my search 
| bin field span 0.5 
| chart count by field
| eval field=replace(field,"^([^-]+)-(.*)","\1")

This will retain the first part of the bin (before hyphen). If you need the second part of bin after hyphen, use \2 instead of \1 i.e. | eval field=replace(field,"^([^-]+)-(.*)","\2")

Following is a run anywhere example with cooked up sample data, based on the question:

| makeresults count=10 
| eval field=random(), field=substr(field,1,1), count=random(), count=substr(count,3) 
| bin field span=0.5
| chart sum(count) as count by field
| eval field=replace(field,"^([^-]+)-(.*)","\1")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Splunknewbuiee
Engager

This works for positive numbers, but what about negative numbers? do we need to have some conditions for this case? 

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...