Splunk Search

Y-axis label using sideview utils

strive
Influencer

Hi,

By default, sideview displays stat(field) as legend and Y-axis label. We want to show just field as legend. We are able to achieve that by doing some modifications in JS file. We want to change Y-axis label as well. How to do it?

Say BytesDelivered is the metric under consideration. We are able to show Bytes Delivered as legend. Same is displayed as Y-axis label. We want to show GB as Y-axis label.

Thanks

Strive

Tags (2)
1 Solution

sideview
SplunkTrust
SplunkTrust

I could implement this as a general feature in the Sideview Report Builder, in that I could provide a lookup or two, ship them empty, and tell customers how to add entries to them so as to a) map field names to the names they want to appear in the legend, and b) map field names to names they want to appear in headers.

However, I've thought about it and it's far too complicated to try and explain step by step. Sideview Report Builder with its automatic pivoting and drilldown behavior, has a lot of moving parts already. Furthermore, I think the only real way to change the field names in JSChart's legend is to.... literally change the field name, and this would perturb the entire automatic drilldown stuff that the Sideview Report Builder has going on.

(To explain: in Splunk's general UI's, a drilldown always takes you to raw events. In Sideview Report Builder, a drilldown always plugs in the arguments (even if they're NULL/OTHER), but leaves you in the report builder. Whatever you drilldown down on in the x-axis and whatever was in the 'split-by' UI is now added as new searchterms, and you're looking at a "count of events over time" for those drilldown events.)

Of course, if you have a particular report that you're interested in, why not use the Report Builder's "Create dashboard" abilities to create your own dashboard from that report... Then you can edit the search language once it's created and use rename and eval as necessary to turn it into GB and rename the field in the legend, etc...

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

I could implement this as a general feature in the Sideview Report Builder, in that I could provide a lookup or two, ship them empty, and tell customers how to add entries to them so as to a) map field names to the names they want to appear in the legend, and b) map field names to names they want to appear in headers.

However, I've thought about it and it's far too complicated to try and explain step by step. Sideview Report Builder with its automatic pivoting and drilldown behavior, has a lot of moving parts already. Furthermore, I think the only real way to change the field names in JSChart's legend is to.... literally change the field name, and this would perturb the entire automatic drilldown stuff that the Sideview Report Builder has going on.

(To explain: in Splunk's general UI's, a drilldown always takes you to raw events. In Sideview Report Builder, a drilldown always plugs in the arguments (even if they're NULL/OTHER), but leaves you in the report builder. Whatever you drilldown down on in the x-axis and whatever was in the 'split-by' UI is now added as new searchterms, and you're looking at a "count of events over time" for those drilldown events.)

Of course, if you have a particular report that you're interested in, why not use the Report Builder's "Create dashboard" abilities to create your own dashboard from that report... Then you can edit the search language once it's created and use rename and eval as necessary to turn it into GB and rename the field in the legend, etc...

0 Karma

strive
Influencer

Hi, I am talking about Sideview Report Builder

0 Karma

sideview
SplunkTrust
SplunkTrust

Are you talking about the Sideview Report Builder? Or are you talking about a custom view that you've developed on your own? If the latter can you include the XML for the view?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...