Splunk Search

Show only every N days in line chart where time is X axis?

msarro
Builder

Below you will find a line chart which I've created. It uses a linear regression to predict what values are going to be at N days in the future based on recent trends. However the downside is, splunk tries to label every single day along the X axis which creates a number of "..." labels which really aren't helpful. It would be better if I could have it only show a label every N days.
Any idea on how to approach this would be great.

alt text

Tags (2)
0 Karma
1 Solution

tfletcher_splun
Splunk Employee
Splunk Employee

JSChart is reading the fields in your search results to do this. I am guessing that you are not using timechart to plot this data which is why that metadata field it is looking for is absent. You can hack it in by ending your search with an eval or you can use a timechart command with a span declaration.

for the hack, the integer represents the jschart's x-axis span:

| eval _span=60

View solution in original post

tfletcher_splun
Splunk Employee
Splunk Employee

JSChart is reading the fields in your search results to do this. I am guessing that you are not using timechart to plot this data which is why that metadata field it is looking for is absent. You can hack it in by ending your search with an eval or you can use a timechart command with a span declaration.

for the hack, the integer represents the jschart's x-axis span:

| eval _span=60

msarro
Builder

This worked really well, thank you!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...