Splunk Search

Column Chart: Why are small data points on a stacked column chart not displaying on some machines?

jimrobson
Explorer

I have a stacked column chart that shows 2 values in each column. One of these values tends to be very small (0-3 events). It works fine on my machine; I can see a thin line at the bottom of each column where this value is greater than 0. However, on some other users' machines, the value is not visible at all. If they hover the mouse cursor over it, the tooltip shows, and they can click to drill down.

What can I do to make the small value display across different machines?

Sample environment where it's not working:
Windows 7 Enterprise SP1
IE: 11.0.9600.18376
Chrome: 45.0.2454.101 m
Firefox: 34.0.5

Runals
Motivator

When you've looked at the data is the line not there because the machines in question didn't create the event or the event value was 0? if it was 0 I'd expect to see the line - if it isn't there I'd guess the data isn't there. A potential is to use the fillnull command if it is the same field every time. Alternatively if there are several possible fields I'd maybe do some sort of foreach.

index=foo | foreach value1 value2 value3 [ eval <<FIELD>> = coalesce(<<FIELD>>, 0) ] 

Perhaps if you showed some sample data it would help. At any rate I'm wondering if the issue is the data not being there vs some sort of browser display issue.

0 Karma

jimrobson
Explorer

Runals - thank you for the response.

The data is there on their machines. If they place a mouse cursor over a column where the value is greater than 0, the tooltip displays showing the number of events. (I was going to add a screen shot, but don't have enough Karma points.) They can click to drill down and see the actual logs.

0 Karma

Runals
Motivator

Ahh I read your message wrong. Other than using the Y axis I've never looked at showing a value in the bar itself. I'm not sure that is an out of the box option - I could well be wrong in that regard though.

0 Karma

jimrobson
Explorer

I'm not trying to show a value in the column.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...