I am charting a range of 30 values (let's call them R) staring around 689511876 ending 690635036. The timechart report gives me a y-axis-min=0 y-axis-max=700,000,000. I want the y-axis min and max to be data dependent, i.e. y-axis-min=min(R) and the y-axis-max=max(R) is there a way to easily do this? If not, how do I get more a more reasonable y-axis range?
1) When you use Splunk's report builder, in the 'format report' view, there are a bunch of options that are often missed. Click 'y-axis' and you'll see textfields where you can set the minimum and maximum range of the report. When you save the report from that interface, these values will get preserved in a 'viewstate' object that's linked to the report.
2) If you dont want the extra baggage of using report builder and viewstates, and you're already comfortable editing your own views, it's quite easy to set this range directly in the view XML:
<param name="charting.secondaryAxis.minimumNumber">650000000</param> <param name="charting.secondaryAxis.maximumNumber">700000000</param>
3) there is a charting key called "charting.chart.axisY.includeZero", and I used it on a weird prototype once to do exactly this, ie snap in snugly around the data automatically. Of course this was a long time ago, and the charting reference also says that the default is 'false' (which doesnt really match observed behavior), so I could be misremembering.
but give it a shot cause it might do what you want:
<param> tags are in the advanced XML syntax, intended to be put inside
HiddenChartFormatter module. If you're using the simplified XML, you use slightly different syntax but you can probably figure that out.
This feature "includeZero=false" was indeed broken, and now it seems to be fixed. However, there is a twist to this. Setting charting.chart.axisY.includeZero will have no effect, and the correct property is now charting.axisY.includeZero
In other words, instead of using <param name="charting.chart.axisY.includeZero">False</param>
Now, you need to use <param name="charting.axisY.includeZero">False</param>
With this fix, our charts can look prettier than ever before.