I have a table which drills down to change a chart:
<row>
<panel>
<table>
<title>Exchanges</title>
<search>
<query>`MS_DDI_Microservices` metric_name="Rate:Exchange:*"
| rex field=metric_name ".*:(?<Exchange>[^:]*):(?<direction>[^:]*)$$"
| chart avg(Average) by Exchange, direction</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
<sampleRatio>1</sampleRatio>
<refresh>$refresh$</refresh>
</search>
<drilldown>
<set token="exchange">$row.Exchange$</set>
</drilldown>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
<panel>
<chart>
<title>$exchange$ Rate</title>
<search>
<query>`MS_DDI_Microservices` metric_name="Rate:Exchange:$exchange$:*"
| rex field=metric_name ":(?<direction>[^:]*)$$"
| timechart avg(Average) by direction</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
<sampleRatio>1</sampleRatio>
<refresh>$refresh$</refresh>
</search>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">collapsed</option>
<option name="charting.axisTitleY2.visibility">collapsed</option>
<option name="charting.axisY.includeZero">1</option>
<option name="charting.chart">line</option>
<option name="charting.chart.nullValueMode">connect</option>
<option name="charting.legend.placement">right</option>
</chart>
</panel>
</row>
When the dashboard draws initially the chart has a y-axis that just includes the data (currently 7.5). When I select a row in the table the chart redraws with the y-axis up to 100, well over what is required. Selecting back to the original row keeps the y-axis maximum value of 100, which renders the data as a tiny curve at the very bottom of the chart.
Any thoughts? I've left the y-axis max at the default, documented as auto. I think it works right the first time but not afterwards.
Splunk Enterprise 6.6.2
@madkins23, the y-axis max by default adjusts based on maximum value to be plotted. So, this seems to be a bug in case your data is nowhere close to 100 and y-axis expands to 100 and you should reach out to Splunk support for assistance.
Can you add screenshot of table and timechart for the first time and after clicking a row as the dummy dashboard on similar line to your example works fine for me?
If you know what your Maximum Y axis label is going to be, you can set the same as token and then use that for configuration of timechart.
Step 1: Following example sets the token maxY
to be used as max y-axis label:
Option i: using <init>
section which would be more static
<init>
<set token="maxY">20</set>
</init>
Option ii: Or adjust dynamically based on clicked values using a dummy search query (PS: Following is just an example based on your current search, you should change the query as per need):
<search>
<query>`MS_DDI_Microservices` metric_name="Rate:Exchange:$exchange$:*"
| rex field=metric_name ":(?<direction>[^:]*)$$"
| timechart avg(Average)
| stats max(avg) as maxAvg
| table maxAvg</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
<sampleRatio>1</sampleRatio>
<done>
<eval token="maxY">$result.maxAvg$+20</eval>
</done>
</search>
Step 2: Then pass the value of maxY
token to Y-axis maximum label i.e. charting.axisY.maximumNumber
<option name="charting.axisY.maximumNumber">$maxY$</option>
PS: You should also add depends
attribute to second panel with timechart based on exchange
token so that it remains hidden until a row is selected in the first table.
<panel depends="$exchange$">
<chart>
<title>$exchange$ Rate</title>
Here are the screen shots:
I noticed some more things this morning:
I created some data for the first row in the table to find and got yesterday's behavior back. I haven't been able to create events for the second row.
My current theory is that when I switch from the first row to the second row (where there are no items) the graph goes from showing a reasonable range to showing the "default range" of 0 - 100. Then when I switch back this range is retained.