Splunk Search

Timechart automatic high resize

ea7777777
New Member

Hi,
I've got a timechart with different columns (depending on the search). If I don't get many columns, the high of the timechart is enough. If I get many columns results, the timechart high is not enough and all will be pressed together.

So I tried to change the high automatically by the column results, but I don't know how to get the correct column results on the "XXXXXXX". $job.resultCount$ is not correct, because it gives me the row results.

Someone an Idea?

            <search>
              <query>Linie=$Token_Linie$  Antyp=$Token_Antyp$  
              | eval combined_field= Linie + " " + Antyp 
              | eventstats count as "totalCount" by An 
              | timechart  count(totalCount) BY combined_field
              </query>
              <earliest>$Token_IO_NIO_Zeit.earliest$</earliest>
              <latest>$Token_IO_NIO_Zeit.latest$</latest>
              <done>
                   <eval token="tokPanelHeight2">100*$XXXXXXX$</eval>
             </done>     
            </search>
            <option name="height">$tokPanelHeight2$</option>

alt text

Thx a lot!!!!!

0 Karma

woodcock
Esteemed Legend

I would not do it this way. I would instead use the format tool to change the Y-axis from linear to log.

0 Karma

ea7777777
New Member

No, that solves not my problem.

My problem ist, if my result shows only one column the display is ok. But if I get more as result the chart get´s pressed together. To rise only the high parameter is also not good, because than the timechart is for one column result to big and for ten column result to small. I need an autoresize of the timechart high....

Good display of one result.
alt text

Bad display example of 4 results.
alt text

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...