Splunk Search

Timechart automatic high resize

ea7777777
New Member

Hi,
I've got a timechart with different columns (depending on the search). If I don't get many columns, the high of the timechart is enough. If I get many columns results, the timechart high is not enough and all will be pressed together.

So I tried to change the high automatically by the column results, but I don't know how to get the correct column results on the "XXXXXXX". $job.resultCount$ is not correct, because it gives me the row results.

Someone an Idea?

            <search>
              <query>Linie=$Token_Linie$  Antyp=$Token_Antyp$  
              | eval combined_field= Linie + " " + Antyp 
              | eventstats count as "totalCount" by An 
              | timechart  count(totalCount) BY combined_field
              </query>
              <earliest>$Token_IO_NIO_Zeit.earliest$</earliest>
              <latest>$Token_IO_NIO_Zeit.latest$</latest>
              <done>
                   <eval token="tokPanelHeight2">100*$XXXXXXX$</eval>
             </done>     
            </search>
            <option name="height">$tokPanelHeight2$</option>

alt text

Thx a lot!!!!!

0 Karma

woodcock
Esteemed Legend

I would not do it this way. I would instead use the format tool to change the Y-axis from linear to log.

0 Karma

ea7777777
New Member

No, that solves not my problem.

My problem ist, if my result shows only one column the display is ok. But if I get more as result the chart get´s pressed together. To rise only the high parameter is also not good, because than the timechart is for one column result to big and for ten column result to small. I need an autoresize of the timechart high....

Good display of one result.
alt text

Bad display example of 4 results.
alt text

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...