Splunk Search

How to change timechart default Y axis default scale?

wangkevin1029
Communicator

Hi,Splunkers,

 

I  have a timechart,  which have value for count by VQ  less than 10,  but default y axis scale is 100, which causes I can't see any column in my timechart.  

how to change the y Axis scale to adjust automatically to my maximum value,  

for example, if max value is less than 10,  than default scale should be 10.

 

wangkevin1029_0-1671379065026.png

 

 

thx in advance.

kevin

 

Labels (1)
0 Karma

wangkevin1029
Communicator

thx,  it looks a little complicated for me.

still not sure why my other timechart works as expected.

I will do more research.

 

thank you very much.

 

 

Kevin

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@wangkevin1029 - You can use the max value in the line chart on Y-Axis.

VatsalJagani_0-1671384776020.png

 

Consider upvoting if this helps!!!

0 Karma

wangkevin1029
Communicator

wangkevin1029_0-1671385588541.png this is working one.

 

wangkevin1029_1-1671385659275.png

 

this is not working one,  total aggragation result is 22,  max value is 100, which I didn't configure it.  

 

 

0 Karma

wangkevin1029
Communicator

Vatsal, 

 

thx for your quick response.

My splunk ver doesn't have this configuration.

however I don't want a fixed max value.  I need an automatic adjust max value here.

and  it works in my other splunk,  I  compared all visualization configuration, they are same.

not sure why other one works.

for the working one,  if the largest value is 7, then  max scale is 10,  if the largest value is 7500, then max scale is 10000.

 

Kevin 

0 Karma

wangkevin1029
Communicator

sorry, i have that max value,  but I don't want a fixed max value.

 

Kevin

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@wangkevin1029 - Then you probably can try doing it under XML by setting it as a token and dynamically generating the token value as the max value.

 

some reference:

 

        <search>
          <query>...</query>
          ...
          <done>
            <set token="tkn_max_value">$result.max_value$</set>
          </done>
        </search>

 

* Option for max value: "charting.axisX.maximumNumber"

 

<chart>
  <search> ... ..
  ...
  <option name="charting.axisX.maximumNumber">$tkn_max_value$</option>
</chart>

 

* See more references - in Splunk's Simple XML reference document.

PS: I have personally not tried with chart configuration parameter but the token works with table options.

 

I hope this helps!!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...