Splunk Search

Column Chart: Why are small data points on a stacked column chart not displaying on some machines?

jimrobson
Explorer

I have a stacked column chart that shows 2 values in each column. One of these values tends to be very small (0-3 events). It works fine on my machine; I can see a thin line at the bottom of each column where this value is greater than 0. However, on some other users' machines, the value is not visible at all. If they hover the mouse cursor over it, the tooltip shows, and they can click to drill down.

What can I do to make the small value display across different machines?

Sample environment where it's not working:
Windows 7 Enterprise SP1
IE: 11.0.9600.18376
Chrome: 45.0.2454.101 m
Firefox: 34.0.5

Runals
Motivator

When you've looked at the data is the line not there because the machines in question didn't create the event or the event value was 0? if it was 0 I'd expect to see the line - if it isn't there I'd guess the data isn't there. A potential is to use the fillnull command if it is the same field every time. Alternatively if there are several possible fields I'd maybe do some sort of foreach.

index=foo | foreach value1 value2 value3 [ eval <<FIELD>> = coalesce(<<FIELD>>, 0) ] 

Perhaps if you showed some sample data it would help. At any rate I'm wondering if the issue is the data not being there vs some sort of browser display issue.

0 Karma

jimrobson
Explorer

Runals - thank you for the response.

The data is there on their machines. If they place a mouse cursor over a column where the value is greater than 0, the tooltip displays showing the number of events. (I was going to add a screen shot, but don't have enough Karma points.) They can click to drill down and see the actual logs.

0 Karma

Runals
Motivator

Ahh I read your message wrong. Other than using the Y axis I've never looked at showing a value in the bar itself. I'm not sure that is an out of the box option - I could well be wrong in that regard though.

0 Karma

jimrobson
Explorer

I'm not trying to show a value in the column.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...