Splunk Search

Timechart automatic high resize

ea7777777
New Member

Hi,
I've got a timechart with different columns (depending on the search). If I don't get many columns, the high of the timechart is enough. If I get many columns results, the timechart high is not enough and all will be pressed together.

So I tried to change the high automatically by the column results, but I don't know how to get the correct column results on the "XXXXXXX". $job.resultCount$ is not correct, because it gives me the row results.

Someone an Idea?

            <search>
              <query>Linie=$Token_Linie$  Antyp=$Token_Antyp$  
              | eval combined_field= Linie + " " + Antyp 
              | eventstats count as "totalCount" by An 
              | timechart  count(totalCount) BY combined_field
              </query>
              <earliest>$Token_IO_NIO_Zeit.earliest$</earliest>
              <latest>$Token_IO_NIO_Zeit.latest$</latest>
              <done>
                   <eval token="tokPanelHeight2">100*$XXXXXXX$</eval>
             </done>     
            </search>
            <option name="height">$tokPanelHeight2$</option>

alt text

Thx a lot!!!!!

0 Karma

woodcock
Esteemed Legend

I would not do it this way. I would instead use the format tool to change the Y-axis from linear to log.

0 Karma

ea7777777
New Member

No, that solves not my problem.

My problem ist, if my result shows only one column the display is ok. But if I get more as result the chart get´s pressed together. To rise only the high parameter is also not good, because than the timechart is for one column result to big and for ten column result to small. I need an autoresize of the timechart high....

Good display of one result.
alt text

Bad display example of 4 results.
alt text

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Analytics Workspace deprecation

As of Splunk Cloud Platform 10.4.2604 and Splunk Enterprise 10.4, Analytics Workspace is now deprecated. ...

Splunk Developer Day Recap: Building, Publishing, and Growing on the Splunk Platform

Splunk Developer Day brought the Splunk developer community together for a practical look at what it means to ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...