topic Re: Specify timestamp display format for timechart axis labels in Getting Data In

Specify timestamp display format for timechart axis labels

chendry — Mon, 14 Feb 2011 21:34:54 GMT

Hi everyone,

I want the timestamps for the X-axis labels of a timechart to have the following format:

MM-DD HH:mm

where HH:mm is in 24-h format, M designates month, m designates minute.

Example: "February 14th, 1PM" should look like "02-14 13:00"

Does anyone now how & where this can be configured?

Thanks!

Re: Specify timestamp display format for timechart axis labels

Ron_Naken — Tue, 15 Feb 2011 01:24:48 GMT

You can use chart to do the same as timechart:

... | eval Time = strftime(_time, "%m/%d %H:%M") | chart count as Total by Time

And it's easy to format a chart...

EDIT:

Based on gkanapathy's comment, it might be better to implement it like this to ensure proper sorting of the time values:

... | eval Time = _time | chart count as Total by Time span=1h | eval Time=strftime(Time, "%m/%d %H:%M")

Re: Specify timestamp display format for timechart axis labels

gkanapathy — Tue, 15 Feb 2011 05:39:20 GMT

That won't quite work, as the Time field will not necessarily be sorted in the right order, and furthermore if the data isn't distributed evenly, your time axis won't be even over time. You can use the makecontinuous command to try to overcome the second problem.

Re: Specify timestamp display format for timechart axis labels

gkanapathy — Tue, 15 Feb 2011 05:43:17 GMT

You should do the chart/timechart, then apply a rename and eval afterwards to solve these issues.

Re: Specify timestamp display format for timechart axis labels

chendry — Tue, 15 Feb 2011 17:06:31 GMT

Thanks for your replies -

The proposed method worked:

... | timechart span=1m sum(HTTP_5xx) | fillnull value=0 | rename _time AS Time | eval Time=strftime(Time, "%m-%d %H:%M")

However, using the above search command, the labels on the X-Axis disappear.

This is how chart labels looked before ("bad" timestamp formatting, but proper labels):

This is how chart labels look now (proper timestamp formatting, but labels not shown):

I use the following chart formatting option the force label visibility:

          <param name="charting.primaryAxisLabels.majorLabelVisibility">show</param>

However, with the reformatted timestamps, the labels only partly appear (i.e. they are still cut off) when stretching the chart horizontally to ~ 2000 pixels...

Re: Specify timestamp display format for timechart axis labels

chendry — Tue, 15 Feb 2011 18:12:12 GMT

I guess the cause for this is that after using strftime(), the chart values on the X-Axis are not anymore of type TIME, but CATEGORY. Unfortunately, I think that it is not possible to properly space the major labels for a CATEGORY axis because the param "charting.axisLabelsX.majorUnit" does not seem to exist for category axis type. Does anyone know how to space category labels?