I'm using a bar chart (stacked) with a search query of sourcetype="log4j" | timechart count by log4j_ERROR_with_3_words
This gives me a top count of errors over the course of 30 days. Unfortunately the bar chart is really small and I only see 2 dates (Jan 16th and Jan 30th) with really small lines. I would love to increase the size of the chart so the X axis (date) can display more text - even every 5th day out of a 30 day spread would be better than what it's showing now.
Is this possible, and if so how? Below is the XML I'm using for the chart
<row>
<chart>
<searchString>sourcetype="stash_log4j" | timechart count by stash_log4j_ERROR_with_3_words</searchString>
<title>30 Day error summary</title>
<earliestTime>-30d@h</earliestTime>
<latestTime>now</latestTime>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleY.text">Number of total errors</option>
<option name="charting.chart">bar</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.layout.splitSeries">false</option>
<option name="charting.legend.placement">bottom</option>
<option name="charting.primaryAxisTitle.text"/>
<option name="charting.secondaryAxis.maximumNumber">""</option>
<option name="charting.secondaryAxis.minimumNumber">""</option>
<option name="charting.secondaryAxis.scale">""</option>
<option name="charting.secondaryAxisTitle.text"/>
<option name="count">50</option>
<option name="displayRowNumbers">true</option>
</chart>
</row>
the below option allowed me to change the size of the chart
<option name="height">1600</option>
I found the answer here:
http://splunk-base.splunk.com/answers/3885/set-height-of-chart-in-view-conf
charting.chart.height did not work
I just had to deal with this issue. I am surprised to not see any good answers.
So I had to figure it out:
<module name="FlashChart">
<param name="width">100%</param>
<param name="height">350px</param>
<module name="Gimp"/>
<module name="ConvertToDrilldownSearch">
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
You have to specify the number, followed by px for pixels. If you put only the number it just won't work.
Also, note that this height is really the height of the chart itself. You have to account for an extra 50 pixels for the frame.
the below option allowed me to change the size of the chart
<option name="height">1600</option>
I found the answer here:
http://splunk-base.splunk.com/answers/3885/set-height-of-chart-in-view-conf
charting.chart.height did not work
Use the span option for your timechart.
...| timechart span=1d count by stash_log4j_ERROR_with_3_words
Also, make sure you put a height option inside your charting options so you can modify the height.
<option name="charting.chart.height">500</option>
do i need to use span to be able to set the height of my chart? I edited the xml and tried adding in the charting.chart.height but my chart would no longer draw. I tried from 500 up to 4500 but still no luck