Dashboards & Visualizations

Pivot graph - How to change Y-axis units

alexantao
Path Finder

HI,
I'm triyng to create a graph in pivot that show the number of bytes over some other field, like IP. So the graph will show the number of bytes each IP downloaded.
But the number of bytes are too high, I'd like to show in Gb, ou Mb, instead of bytes.
The field auto-extracted from the datamodel is bytes. I've tried to create an eval field that contains Bytes/1073741824 to transform to Gb but the graph does not show anything.

Is there a way to splunk automatcally transform big numbers using the units ? Or how could I do that ?

Thanks.

0 Karma

mattness
Splunk Employee
Splunk Employee

Here are the steps you should follow:

  1. Add bytes as an auto-extracted attribute to the data model object you're using for your Pivot. You need this in your object if you want to reference the bytes attribute in the eval expression attribute (next step).
  2. Add an eval expression attribute to the same object. In the Eval Expression field for the attribute enter bytes/1073741824. Then give it a Field Name and Display Name of Gb. (Note: Splunk is case-sensitive when it comes to field names, so if your field is extracted as "bytes," don't use "Bytes" in the eval expression.)
  3. Test the Eval Expression attribute by clicking Preview. You should see some events with a new Gb field added.
  4. Save the eval expression attribute.
  5. In your pivot chart, use Gb where you were using bytes. Presto!

The object UI should do this automatically, but just in case: Make sure that the Gb eval expression attribute is listed below the bytes auto-extracted attribute. The eval expression attribute cannot reference attributes that are listed after it.

You can also add these attributes to a parent of the object you're using in Pivot; the object you're using in Pivot will inherit them.

mattness
Splunk Employee
Splunk Employee

Ah, one more thing...it's case sensitive. So if your field is being extracted as "bytes" don't enter "Bytes/1073741824" into the Eval Expression field.

mattness
Splunk Employee
Splunk Employee

I tested this on my end before writing up that procedure and it worked for me...I thought perhaps the problem was that you didn't have the bytes auto-extracted attribute in the object.

0 Karma

alexantao
Path Finder

I've tried this, but it didn't work, but I'll try again... thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...