Splunk Search

How to modify x-axis labels to show bin centers?

rtakatsuka
Engager

I am trying to create a histogram plot, but I want to make the x-axis labels more readable. How do I go about doing this?

Here is what I am doing:

my search | bin field span 0.5 | chart count by field

Here is an example of the x-axis when create the chart. Is there a way to force the x-axis to show single values for each bin (at the bin center)? Or even better, can I force the x-axis to place integer labels at their respective positions relative to my bins?

alt text

Labels (3)

niketn
Legend

@rtakatsuka Please try the following:

my search 
| bin field span 0.5 
| chart count by field
| eval field=replace(field,"^([^-]+)-(.*)","\1")

This will retain the first part of the bin (before hyphen). If you need the second part of bin after hyphen, use \2 instead of \1 i.e. | eval field=replace(field,"^([^-]+)-(.*)","\2")

Following is a run anywhere example with cooked up sample data, based on the question:

| makeresults count=10 
| eval field=random(), field=substr(field,1,1), count=random(), count=substr(count,3) 
| bin field span=0.5
| chart sum(count) as count by field
| eval field=replace(field,"^([^-]+)-(.*)","\1")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Splunknewbuiee
Engager

This works for positive numbers, but what about negative numbers? do we need to have some conditions for this case? 

0 Karma
Get Updates on the Splunk Community!

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...