Hi, I am creating an area chart to show my application's response time over the last 24 hours and each tick is the aggregrated average response time of 30 minutes
| bucket _time span=30m | STATS avg(time_taken) BY _time
There are 2 questions:
1. Timeline on Y axis is not viewable because the original text (6/11/12 6:00:00.000 AM) is too long. How can I format it like 11AM, 2PM, etc?
2. How can I pick a different area chart color I prefer? by editting default.css?
Thanks!
You can use the fieldformat
command to reformat _time:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fieldformat
Check out the charting.seriesColors
option as documented here:
http://docs.splunk.com/Documentation/Splunk/4.3/Developer/CustomChartingConfig-FontColorBrushPalette
You can use the fieldformat
command to reformat _time:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fieldformat
Check out the charting.seriesColors
option as documented here:
http://docs.splunk.com/Documentation/Splunk/4.3/Developer/CustomChartingConfig-FontColorBrushPalette
Awesome! Good work.
I got it working. Thanks!
Thanks for the info. I found the link of the Simple XML
http://splunk:8000/en-US/app/search/TestDashboard
and also saw the advanced xml including the XML source.
http://splunk:8000/en-US/app/search/TestDashboard?showsource=1
However, the xml does have the foregroundcolor defined below. How come I still didn't see red in the area chart? Thanks!
OK, totally my fault for not asking, but you are using what we call Simple XML.
To exercise greater control over things like charting colors, you would need to convert your existing view to Advanced XML - see http://splunk-base.splunk.com/answers/1/how-can-i-convert-simple-view-xml-to-advanced-xml if you want to go that route.
The reason you can't just use CSS is that the chart elements are canvas objects which are styled in-line.
I added the line
"0xFF0000"
but the area chart color doesn't change to red.
Any idea?
<?xml version='1.0' encoding='utf-8'?>
area
0xFF0000
50
true