Splunk Search

Y-axis label using sideview utils

strive
Influencer

Hi,

By default, sideview displays stat(field) as legend and Y-axis label. We want to show just field as legend. We are able to achieve that by doing some modifications in JS file. We want to change Y-axis label as well. How to do it?

Say BytesDelivered is the metric under consideration. We are able to show Bytes Delivered as legend. Same is displayed as Y-axis label. We want to show GB as Y-axis label.

Thanks

Strive

Tags (2)
1 Solution

sideview
SplunkTrust
SplunkTrust

I could implement this as a general feature in the Sideview Report Builder, in that I could provide a lookup or two, ship them empty, and tell customers how to add entries to them so as to a) map field names to the names they want to appear in the legend, and b) map field names to names they want to appear in headers.

However, I've thought about it and it's far too complicated to try and explain step by step. Sideview Report Builder with its automatic pivoting and drilldown behavior, has a lot of moving parts already. Furthermore, I think the only real way to change the field names in JSChart's legend is to.... literally change the field name, and this would perturb the entire automatic drilldown stuff that the Sideview Report Builder has going on.

(To explain: in Splunk's general UI's, a drilldown always takes you to raw events. In Sideview Report Builder, a drilldown always plugs in the arguments (even if they're NULL/OTHER), but leaves you in the report builder. Whatever you drilldown down on in the x-axis and whatever was in the 'split-by' UI is now added as new searchterms, and you're looking at a "count of events over time" for those drilldown events.)

Of course, if you have a particular report that you're interested in, why not use the Report Builder's "Create dashboard" abilities to create your own dashboard from that report... Then you can edit the search language once it's created and use rename and eval as necessary to turn it into GB and rename the field in the legend, etc...

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

I could implement this as a general feature in the Sideview Report Builder, in that I could provide a lookup or two, ship them empty, and tell customers how to add entries to them so as to a) map field names to the names they want to appear in the legend, and b) map field names to names they want to appear in headers.

However, I've thought about it and it's far too complicated to try and explain step by step. Sideview Report Builder with its automatic pivoting and drilldown behavior, has a lot of moving parts already. Furthermore, I think the only real way to change the field names in JSChart's legend is to.... literally change the field name, and this would perturb the entire automatic drilldown stuff that the Sideview Report Builder has going on.

(To explain: in Splunk's general UI's, a drilldown always takes you to raw events. In Sideview Report Builder, a drilldown always plugs in the arguments (even if they're NULL/OTHER), but leaves you in the report builder. Whatever you drilldown down on in the x-axis and whatever was in the 'split-by' UI is now added as new searchterms, and you're looking at a "count of events over time" for those drilldown events.)

Of course, if you have a particular report that you're interested in, why not use the Report Builder's "Create dashboard" abilities to create your own dashboard from that report... Then you can edit the search language once it's created and use rename and eval as necessary to turn it into GB and rename the field in the legend, etc...

0 Karma

strive
Influencer

Hi, I am talking about Sideview Report Builder

0 Karma

sideview
SplunkTrust
SplunkTrust

Are you talking about the Sideview Report Builder? Or are you talking about a custom view that you've developed on your own? If the latter can you include the XML for the view?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...