Splunk Search

increase the size of a chart

infinitiguy
Path Finder

I'm using a bar chart (stacked) with a search query of sourcetype="log4j" | timechart count by log4j_ERROR_with_3_words

This gives me a top count of errors over the course of 30 days. Unfortunately the bar chart is really small and I only see 2 dates (Jan 16th and Jan 30th) with really small lines. I would love to increase the size of the chart so the X axis (date) can display more text - even every 5th day out of a 30 day spread would be better than what it's showing now.

Is this possible, and if so how? Below is the XML I'm using for the chart

  <row>
    <chart>
      <searchString>sourcetype="stash_log4j" | timechart count by   stash_log4j_ERROR_with_3_words</searchString>
      <title>30 Day error summary</title>
      <earliestTime>-30d@h</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.axisTitleX.text">Date</option>
      <option name="charting.axisTitleY.text">Number of total errors</option>
      <option name="charting.chart">bar</option>
      <option name="charting.chart.nullValueMode">gaps</option>
      <option name="charting.chart.stackMode">stacked</option>
      <option name="charting.layout.splitSeries">false</option>
      <option name="charting.legend.placement">bottom</option>
      <option name="charting.primaryAxisTitle.text"/>
      <option name="charting.secondaryAxis.maximumNumber">""</option>
      <option name="charting.secondaryAxis.minimumNumber">""</option>
      <option name="charting.secondaryAxis.scale">""</option>
      <option name="charting.secondaryAxisTitle.text"/>
      <option name="count">50</option>
      <option name="displayRowNumbers">true</option>
    </chart>
  </row>
Tags (3)
0 Karma
1 Solution

infinitiguy
Path Finder

the below option allowed me to change the size of the chart

 <option name="height">1600</option> 

I found the answer here:
http://splunk-base.splunk.com/answers/3885/set-height-of-chart-in-view-conf

charting.chart.height did not work

View solution in original post

sansay
Contributor

I just had to deal with this issue. I am surprised to not see any good answers.
So I had to figure it out:

<module name="FlashChart">
<param name="width">100%</param>
<param name="height">350px</param>
<module name="Gimp"/>
<module name="ConvertToDrilldownSearch">
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>

You have to specify the number, followed by px for pixels. If you put only the number it just won't work.
Also, note that this height is really the height of the chart itself. You have to account for an extra 50 pixels for the frame.

0 Karma

infinitiguy
Path Finder

the below option allowed me to change the size of the chart

 <option name="height">1600</option> 

I found the answer here:
http://splunk-base.splunk.com/answers/3885/set-height-of-chart-in-view-conf

charting.chart.height did not work

Lamar
Splunk Employee
Splunk Employee

Use the span option for your timechart.


...| timechart span=1d count by stash_log4j_ERROR_with_3_words

Also, make sure you put a height option inside your charting options so you can modify the height.


<option name="charting.chart.height">500</option>

0 Karma

infinitiguy
Path Finder

do i need to use span to be able to set the height of my chart? I edited the xml and tried adding in the charting.chart.height but my chart would no longer draw. I tried from 500 up to 4500 but still no luck

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...