Redrawing chart changes y axis maximum

[madkins23]

I have a table which drills down to change a chart:

  <row>
    <panel>
      <table>
        <title>Exchanges</title>
        <search>
          <query>`MS_DDI_Microservices` metric_name="Rate:Exchange:*"
            | rex field=metric_name ".*:(?&lt;Exchange&gt;[^:]*):(?&lt;direction&gt;[^:]*)$$"
            | chart avg(Average) by Exchange, direction</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
          <sampleRatio>1</sampleRatio>
          <refresh>$refresh$</refresh>
        </search>
        <drilldown>
          <set token="exchange">$row.Exchange$</set>
        </drilldown>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <chart>
        <title>$exchange$ Rate</title>
        <search>
          <query>`MS_DDI_Microservices` metric_name="Rate:Exchange:$exchange$:*"
            | rex field=metric_name ":(?&lt;direction&gt;[^:]*)$$"
            | timechart avg(Average) by direction</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
          <sampleRatio>1</sampleRatio>
          <refresh>$refresh$</refresh>
        </search>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">collapsed</option>
        <option name="charting.axisY.includeZero">1</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.nullValueMode">connect</option>
        <option name="charting.legend.placement">right</option>
      </chart>
    </panel>
  </row>

When the dashboard draws initially the chart has a y-axis that just includes the data (currently 7.5). When I select a row in the table the chart redraws with the y-axis up to 100, well over what is required. Selecting back to the original row keeps the y-axis maximum value of 100, which renders the data as a tiny curve at the very bottom of the chart.

Any thoughts? I've left the y-axis max at the default, documented as auto. I think it works right the first time but not afterwards.

Splunk Enterprise 6.6.2

[niketn]

@madkins23, the y-axis max by default adjusts based on maximum value to be plotted. So, this seems to be a bug in case your data is nowhere close to 100 and y-axis expands to 100 and you should reach out to Splunk support for assistance.

Can you add screenshot of table and timechart for the first time and after clicking a row as the dummy dashboard on similar line to your example works fine for me?

If you know what your Maximum Y axis label is going to be, you can set the same as token and then use that for configuration of timechart.

Step 1: Following example sets the token maxY to be used as max y-axis label:
Option i: using <init> section which would be more static

<init>
    <set token="maxY">20</set>
</init>

Option ii: Or adjust dynamically based on clicked values using a dummy search query (PS: Following is just an example based on your current search, you should change the query as per need):

  <search>
    <query>`MS_DDI_Microservices` metric_name="Rate:Exchange:$exchange$:*"
             | rex field=metric_name ":(?<direction>[^:]*)$$"
             | timechart avg(Average) 
             | stats max(avg) as maxAvg
             | table maxAvg</query>
    <earliest>$time.earliest$</earliest>
    <latest>$time.latest$</latest>
    <sampleRatio>1</sampleRatio>
    <done>
      <eval token="maxY">$result.maxAvg$+20</eval>
    </done>
  </search>

Step 2: Then pass the value of maxY token to Y-axis maximum label i.e. charting.axisY.maximumNumber

    <option name="charting.axisY.maximumNumber">$maxY$</option>

PS: You should also add depends attribute to second panel with timechart based on exchange token so that it remains hidden until a row is selected in the first table.

 <panel depends="$exchange$">
   <chart>
     <title>$exchange$ Rate</title>

[madkins23]

Here are the screen shots:

I noticed some more things this morning:

• When I got in there were no events so the graph was all zeros.
• With nothing but zeros the graph goes from 0 - 100 "by default".
• The other entry in the table presents a graph which currently is all zeros.

I created some data for the first row in the table to find and got yesterday's behavior back. I haven't been able to create events for the second row.

My current theory is that when I switch from the first row to the second row (where there are no items) the graph goes from showing a reasonable range to showing the "default range" of 0 - 100. Then when I switch back this range is retained.