Splunk Search

Redrawing chart changes y axis maximum

madkins23
New Member

I have a table which drills down to change a chart:

  <row>
    <panel>
      <table>
        <title>Exchanges</title>
        <search>
          <query>`MS_DDI_Microservices` metric_name="Rate:Exchange:*"
            | rex field=metric_name ".*:(?&lt;Exchange&gt;[^:]*):(?&lt;direction&gt;[^:]*)$$"
            | chart avg(Average) by Exchange, direction</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
          <sampleRatio>1</sampleRatio>
          <refresh>$refresh$</refresh>
        </search>
        <drilldown>
          <set token="exchange">$row.Exchange$</set>
        </drilldown>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <chart>
        <title>$exchange$ Rate</title>
        <search>
          <query>`MS_DDI_Microservices` metric_name="Rate:Exchange:$exchange$:*"
            | rex field=metric_name ":(?&lt;direction&gt;[^:]*)$$"
            | timechart avg(Average) by direction</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
          <sampleRatio>1</sampleRatio>
          <refresh>$refresh$</refresh>
        </search>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">collapsed</option>
        <option name="charting.axisY.includeZero">1</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.nullValueMode">connect</option>
        <option name="charting.legend.placement">right</option>
      </chart>
    </panel>
  </row>

When the dashboard draws initially the chart has a y-axis that just includes the data (currently 7.5). When I select a row in the table the chart redraws with the y-axis up to 100, well over what is required. Selecting back to the original row keeps the y-axis maximum value of 100, which renders the data as a tiny curve at the very bottom of the chart.

Any thoughts? I've left the y-axis max at the default, documented as auto. I think it works right the first time but not afterwards.

Splunk Enterprise 6.6.2

0 Karma

niketnilay
Legend

@madkins23, the y-axis max by default adjusts based on maximum value to be plotted. So, this seems to be a bug in case your data is nowhere close to 100 and y-axis expands to 100 and you should reach out to Splunk support for assistance.

Can you add screenshot of table and timechart for the first time and after clicking a row as the dummy dashboard on similar line to your example works fine for me?

If you know what your Maximum Y axis label is going to be, you can set the same as token and then use that for configuration of timechart.

Step 1: Following example sets the token maxY to be used as max y-axis label:
Option i: using <init> section which would be more static

<init>
    <set token="maxY">20</set>
</init>

Option ii: Or adjust dynamically based on clicked values using a dummy search query (PS: Following is just an example based on your current search, you should change the query as per need):

  <search>
    <query>`MS_DDI_Microservices` metric_name="Rate:Exchange:$exchange$:*"
             | rex field=metric_name ":(?<direction>[^:]*)$$"
             | timechart avg(Average) 
             | stats max(avg) as maxAvg
             | table maxAvg</query>
    <earliest>$time.earliest$</earliest>
    <latest>$time.latest$</latest>
    <sampleRatio>1</sampleRatio>
    <done>
      <eval token="maxY">$result.maxAvg$+20</eval>
    </done>
  </search>

Step 2: Then pass the value of maxY token to Y-axis maximum label i.e. charting.axisY.maximumNumber

    <option name="charting.axisY.maximumNumber">$maxY$</option>

PS: You should also add depends attribute to second panel with timechart based on exchange token so that it remains hidden until a row is selected in the first table.

 <panel depends="$exchange$">
   <chart>
     <title>$exchange$ Rate</title>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

madkins23
New Member

Here are the screen shots:

When dashboard initially displays
After switching to another table choice and switching back

I noticed some more things this morning:

  • When I got in there were no events so the graph was all zeros.
  • With nothing but zeros the graph goes from 0 - 100 "by default".
  • The other entry in the table presents a graph which currently is all zeros.

I created some data for the first row in the table to find and got yesterday's behavior back. I haven't been able to create events for the second row.

My current theory is that when I switch from the first row to the second row (where there are no items) the graph goes from showing a reasonable range to showing the "default range" of 0 - 100. Then when I switch back this range is retained.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...