Dashboards & Visualizations

Area Chart format timestamp

shangshin
Builder

Hi, I am creating an area chart to show my application's response time over the last 24 hours and each tick is the aggregrated average response time of 30 minutes

 | bucket _time span=30m | STATS avg(time_taken) BY _time

There are 2 questions:
1. Timeline on Y axis is not viewable because the original text (6/11/12 6:00:00.000 AM) is too long. How can I format it like 11AM, 2PM, etc?
2. How can I pick a different area chart color I prefer? by editting default.css?

Thanks!

Tags (1)
1 Solution

araitz
Splunk Employee
Splunk Employee
0 Karma

araitz
Splunk Employee
Splunk Employee

You can use the fieldformat command to reformat _time:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fieldformat

Check out the charting.seriesColors option as documented here:

http://docs.splunk.com/Documentation/Splunk/4.3/Developer/CustomChartingConfig-FontColorBrushPalette
0 Karma

araitz
Splunk Employee
Splunk Employee

Awesome! Good work.

shangshin
Builder

I got it working. Thanks!

shangshin
Builder

Thanks for the info. I found the link of the Simple XML
http://splunk:8000/en-US/app/search/TestDashboard

and also saw the advanced xml including the XML source.
http://splunk:8000/en-US/app/search/TestDashboard?showsource=1

However, the xml does have the foregroundcolor defined below. How come I still didn't see red in the area chart? Thanks!


0xFF0000
area

0 Karma

araitz
Splunk Employee
Splunk Employee

OK, totally my fault for not asking, but you are using what we call Simple XML.

To exercise greater control over things like charting colors, you would need to convert your existing view to Advanced XML - see http://splunk-base.splunk.com/answers/1/how-can-i-convert-simple-view-xml-to-advanced-xml if you want to go that route.

The reason you can't just use CSS is that the chart elements are canvas objects which are styled in-line.

shangshin
Builder

I added the line
"0xFF0000"

but the area chart color doesn't change to red.
Any idea?

<?xml version='1.0' encoding='utf-8'?>




Response Time last 4 hrs
Test
area
0xFF0000
50
true


0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...