Splunk Search

I have 90 days data and i want to display in column chart. i am getting all the data but x axis label is missing. how to fix it

DataOrg
Builder

X axis label is missing. if i reduce the no of data i am getting label. how to accommodate all data with x axis label

0 Karma
1 Solution

niketn
Legend

@premranjithj, try rotating the axis label by 90 degrees.

<option name="charting.axisLabelsX.majorLabelStyle.rotation">90</option>

https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference

You can also see having only one panel per row, that will accommodate more data points in the chart. How many data points do you have? Is it one per day? You can format time on X-axis for display in shorter format using fieldformat command. For example:

| fieldformat _time=strftime(_time,"%m-%d")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@premranjithj, try rotating the axis label by 90 degrees.

<option name="charting.axisLabelsX.majorLabelStyle.rotation">90</option>

https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference

You can also see having only one panel per row, that will accommodate more data points in the chart. How many data points do you have? Is it one per day? You can format time on X-axis for display in shorter format using fieldformat command. For example:

| fieldformat _time=strftime(_time,"%m-%d")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

DataOrg
Builder

its one per day. i am not able to plot still after changing to 90

0 Karma

niketn
Legend

You can perform | head 60 or | head 50 to see how many labels can be displayed in x-axis as per your display area width. While 90 did not work for me 60 did.

If x-axis is _time epoch field, and you are using timechart command to plot your series then x-axis will adjust time labels to be displayed. You can also check out Punchcard visualization to see if it fits depicting the visualization as you require.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

DataOrg
Builder

head 60 or head 50 will work.. is there any possibility to display all the values

0 Karma

niketn
Legend

I think with Column chart one of the options is to reduce browser display size to less than 100% so that available width for the chart increases. Can you check out Puchcard Custom Visualization whether it fits the need? Punchcard can display more labels in x-axis however it may overlap values.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

Can you share at least the final pipe for generating stats for display?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

DataOrg
Builder

|stats sum(INcome) sum(spending) max(remaining) by TS.
i use remaining as overlay

0 Karma

niketn
Legend

What is TS? can you add some sample values for TS

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

DataOrg
Builder

TS is date value

0 Karma

niketn
Legend

Is it date in string format or epoch format? The reason why I ask is if you switch to timechart instead of stats, then x-axis will adjust on its own.

For example:

| eval TS=strptime(TS,"%Y/%m/%d")
| eval _time=TS
| timechart span=1d sum(INcome) as Income sum(spending) as Expense max(remaining) as Saving

PS: eval with strptime() will not be required if TS is epoch time. This eval is required only if TS is string time.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

niketn
Legend

@premranjithj, I am converting my comments to answer. If these comments have helped, please accept to mark this question as answered.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...