Splunk Search

Column Chart: Why are small data points on a stacked column chart not displaying on some machines?

jimrobson
Explorer

I have a stacked column chart that shows 2 values in each column. One of these values tends to be very small (0-3 events). It works fine on my machine; I can see a thin line at the bottom of each column where this value is greater than 0. However, on some other users' machines, the value is not visible at all. If they hover the mouse cursor over it, the tooltip shows, and they can click to drill down.

What can I do to make the small value display across different machines?

Sample environment where it's not working:
Windows 7 Enterprise SP1
IE: 11.0.9600.18376
Chrome: 45.0.2454.101 m
Firefox: 34.0.5

Runals
Motivator

When you've looked at the data is the line not there because the machines in question didn't create the event or the event value was 0? if it was 0 I'd expect to see the line - if it isn't there I'd guess the data isn't there. A potential is to use the fillnull command if it is the same field every time. Alternatively if there are several possible fields I'd maybe do some sort of foreach.

index=foo | foreach value1 value2 value3 [ eval <<FIELD>> = coalesce(<<FIELD>>, 0) ] 

Perhaps if you showed some sample data it would help. At any rate I'm wondering if the issue is the data not being there vs some sort of browser display issue.

0 Karma

jimrobson
Explorer

Runals - thank you for the response.

The data is there on their machines. If they place a mouse cursor over a column where the value is greater than 0, the tooltip displays showing the number of events. (I was going to add a screen shot, but don't have enough Karma points.) They can click to drill down and see the actual logs.

0 Karma

Runals
Motivator

Ahh I read your message wrong. Other than using the Y axis I've never looked at showing a value in the bar itself. I'm not sure that is an out of the box option - I could well be wrong in that regard though.

0 Karma

jimrobson
Explorer

I'm not trying to show a value in the column.

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...