Splunk Search

Show only every N days in line chart where time is X axis?

msarro
Builder

Below you will find a line chart which I've created. It uses a linear regression to predict what values are going to be at N days in the future based on recent trends. However the downside is, splunk tries to label every single day along the X axis which creates a number of "..." labels which really aren't helpful. It would be better if I could have it only show a label every N days.
Any idea on how to approach this would be great.

alt text

Tags (2)
0 Karma
1 Solution

tfletcher_splun
Splunk Employee
Splunk Employee

JSChart is reading the fields in your search results to do this. I am guessing that you are not using timechart to plot this data which is why that metadata field it is looking for is absent. You can hack it in by ending your search with an eval or you can use a timechart command with a span declaration.

for the hack, the integer represents the jschart's x-axis span:

| eval _span=60

View solution in original post

tfletcher_splun
Splunk Employee
Splunk Employee

JSChart is reading the fields in your search results to do this. I am guessing that you are not using timechart to plot this data which is why that metadata field it is looking for is absent. You can hack it in by ending your search with an eval or you can use a timechart command with a span declaration.

for the hack, the integer represents the jschart's x-axis span:

| eval _span=60

msarro
Builder

This worked really well, thank you!

0 Karma
Get Updates on the Splunk Community!

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...