Splunk Search

Why is the charting.reverse option for scatter chart not working in my dashboard panel?

muellernc
Engager

Dear Splunk Community,

In the current implementation of my dashboard, I have a scatter chart panel for which I am trying to turn the y-axis upside down (minValue is 340, should be at the top; maxValue is 490, should be at the bottom). When searching for this issue, I stumbled upon the true feature, which does not seem to effect the plotting at all. I am using Splunk Enterprise 6.4.1. Is it possible that this option does not work anymore as I was not able to find any current documentation? Here is the xml-code in question:

<dashboard>
  <label>Test</label>
  <row>
    <panel>
      <chart>
        <title>SpurVL</title>
        <search>
          <query>source="/home/ubuntu/test/out/*" host="ip-172-31-24-90" sourcetype="spursturz" | table Umkehrpunkt SpurVL HoeheVL</query>
          <earliest>0</earliest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">scatter</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.axisX.minimumNumber">-10</option>
        <option name="charting.axisX.maximumNumber">35</option>
        <option name="charting.axisY.minimumNumber">490</option> 
        <option name="charting.axisY.maximumNumber">340</option>
        <option name="charting.axisY.reverse">true</option>
        <option name="charting.chart.showMarkers">true</option>
        <option name="charting.chart.markerSize">1</option>
      </chart>
    </panel>
  </row>

Thanks in advance!

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

Hi @muellernc,
This is not a currently supported option for Simple XML.

Hope this helps!

muellernc
Engager

Thanks for your reply!
As I understand the situation advanced xml is deprecated as of Splunk 6.3. Does this therefore indicate that there is no option to reverse an axis anymore? (except for a "cheating" solution by multiplying y axis values with -1)

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

Hi!
It's correct that Advanced XML is deprecated as of 6.3 and there is not a supported way to reverse an axis in Simple XML currently.

Hope this helps!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...