Splunk Search

Show only every N days in line chart where time is X axis?

msarro
Builder

Below you will find a line chart which I've created. It uses a linear regression to predict what values are going to be at N days in the future based on recent trends. However the downside is, splunk tries to label every single day along the X axis which creates a number of "..." labels which really aren't helpful. It would be better if I could have it only show a label every N days.
Any idea on how to approach this would be great.

alt text

Tags (2)
0 Karma
1 Solution

tfletcher_splun
Splunk Employee
Splunk Employee

JSChart is reading the fields in your search results to do this. I am guessing that you are not using timechart to plot this data which is why that metadata field it is looking for is absent. You can hack it in by ending your search with an eval or you can use a timechart command with a span declaration.

for the hack, the integer represents the jschart's x-axis span:

| eval _span=60

View solution in original post

tfletcher_splun
Splunk Employee
Splunk Employee

JSChart is reading the fields in your search results to do this. I am guessing that you are not using timechart to plot this data which is why that metadata field it is looking for is absent. You can hack it in by ending your search with an eval or you can use a timechart command with a span declaration.

for the hack, the integer represents the jschart's x-axis span:

| eval _span=60

msarro
Builder

This worked really well, thank you!

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...