All Apps and Add-ons

How to show majorUnit and minorUnit on x-axis?

royimad
Builder

I need to draw a chart with 2 values on x-axis , how to do that?
Herby the code sample that i'm using:

<view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html">
<label>Web Services Trends</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="SideviewUtils" layoutPanel="appHeader"/>
<module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
</module>
<module name="Message" layoutPanel="messaging">
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
</module>
<module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
</module>
<module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" group="Sum of Claims" autoRun="True">
    <param name="savedSearch">RELEASECHECK2</param>

    <module name="HiddenChartFormatter">
        <param name="chart">line</param>
        <option name="charting.axisX">time</option>
        <param name="charting.axislabelsX.majorUnit">RELEASEDATE</param>
        <param name="charting.axislabelsX.minorUnit">RELEASENAME</param>
        <param name="charting.axislabelsY.majorUnit">data</param>
        <param name="charting.axislabelsY.minorUnit">data</param>

        <!--
        <param name="layout.axisLabelsX.minorTickVisibility">yes</param>
        <param name="layout.axisLabelsX.majorTickVisibility">yes</param>
        -->

        <option name="charting.axisX.comparator">RELEASENAME</option>

        <param name="primaryAxisTitle.text">x axis name</param>
        <param name="secondaryAxisTitle.text">y axis name</param>
        <module name="FlashChart"/>
    </module>

</module>  

</view>

sideview
SplunkTrust
SplunkTrust

That would be very cool if the charting framework could do that - if it could take two different fields RELEASEDATE and RELEASENAME, and use one for the major markers on the x-axis, and the other values for the minor-markers.

But I'm virtually certain that this is not possible. Someone else may surprise us here - it wouldn't be the first time that awesome functionality was deeply buried in the Splunk charting framework.

The good news is that I think you can get what you want by exploring charts like:

foo | chart count over RELEASEDATE by RELEASENAME   

and then graph that as a column chart. If you'd rather have the column bars stacked above eachother within a given RELEASEDATE, you can set charting.chart.stackMode to stacked.

NOTE: you're mixing simple-xml syntax inside your HiddenChartFormatter. Surprisingly I think the advanced XML wont throw any error, but it will be totally ignoring those <option> nodes. Replace them with equivalent <param> nodes if you want them to be used.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...