Splunk Search

Timechart automatic high resize

ea7777777
New Member

Hi,
I've got a timechart with different columns (depending on the search). If I don't get many columns, the high of the timechart is enough. If I get many columns results, the timechart high is not enough and all will be pressed together.

So I tried to change the high automatically by the column results, but I don't know how to get the correct column results on the "XXXXXXX". $job.resultCount$ is not correct, because it gives me the row results.

Someone an Idea?

            <search>
              <query>Linie=$Token_Linie$  Antyp=$Token_Antyp$  
              | eval combined_field= Linie + " " + Antyp 
              | eventstats count as "totalCount" by An 
              | timechart  count(totalCount) BY combined_field
              </query>
              <earliest>$Token_IO_NIO_Zeit.earliest$</earliest>
              <latest>$Token_IO_NIO_Zeit.latest$</latest>
              <done>
                   <eval token="tokPanelHeight2">100*$XXXXXXX$</eval>
             </done>     
            </search>
            <option name="height">$tokPanelHeight2$</option>

alt text

Thx a lot!!!!!

0 Karma

woodcock
Esteemed Legend

I would not do it this way. I would instead use the format tool to change the Y-axis from linear to log.

0 Karma

ea7777777
New Member

No, that solves not my problem.

My problem ist, if my result shows only one column the display is ok. But if I get more as result the chart get´s pressed together. To rise only the high parameter is also not good, because than the timechart is for one column result to big and for ten column result to small. I need an autoresize of the timechart high....

Good display of one result.
alt text

Bad display example of 4 results.
alt text

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...