topic Re: help on _time fied format on x axis in Dashboards & Visualizations

How to display events between 7h in the morning and 19h in the evening?

jip31 — Tue, 08 Mar 2022 04:31:54 GMT

hello

In my timechart, I just need to display events between 7h in the morning and 19h in the evening

So I am doing this and it works fine

| eval local_time=strftime('_time', "%H%M") | search local_time >="0700" AND local_time <="1900" | timechart span=5min dc(s) as "s"

but I also need to display on my x axis timechart, only the hour between 7h in the morning and 19h in the evening

So I add this and it works too

| eval _time=local_time

But the problem I have is that I lost the _time fomat because now the format is in hour minutes

How to do for avoid this please?

Re: help on _time fied format on x axis

PickleRick — Mon, 07 Mar 2022 11:51:10 GMT

Do it the other way around. Don't render the _time field to string, check if the timestamp modulo 86400 falls between 7*3600 and 19*3600. You might need to offset it by your local timezone.

Re: help on _time fied format on x axis

jip31 — Mon, 07 Mar 2022 13:10:30 GMT

hum, not sure to understand

Have you an example please?

Re: help on _time fied format on x axis

ITWhisperer — Mon, 07 Mar 2022 14:12:25 GMT

What are you expecting your x-axis to contain?

Re: help on _time fied format on x axis

PickleRick — Mon, 07 Mar 2022 14:39:37 GMT

<your_search> | where (_time % 86400 > 9*3600) AND (_time<17 *3600)

This will work in GMT. In case of another timeone you'll have to replace _time with (_time+offset) where offset is expressed in seconds, like 3600 for GMT+1, 7200 for GMT+2 and so on.

Re: help on _time fied format on x axis

jip31 — Mon, 07 Mar 2022 15:23:09 GMT

Because i use "today" in the time picher, I need to display hour with a span of 1 hour between 7h and 19h

Re: help on _time fied format on x axis

ITWhisperer — Mon, 07 Mar 2022 15:56:03 GMT

| timechart span=1h dc(s) as "s"

Re: help on _time fied format on x axis

jip31 — Mon, 07 Mar 2022 18:00:46 GMT

sorry but it gives nothing

Re: help on _time fied format on x axis

jip31 — Mon, 07 Mar 2022 18:02:25 GMT

I thing you didnt understood my need, sorry

Re: help on _time fied format on x axis

jip31 — Mon, 07 Mar 2022 18:04:53 GMT

As you can see on x axis, instaed having 7:00, 8:00, 9:00 etc.... I have 1972, 1976, 1980....

Re: help on _time fied format on x axis

somesoni2 — Mon, 07 Mar 2022 18:51:27 GMT

Why not just reduce the timerange to that time period of the day so that your timechart runs only for 07:00AM and 07:00PM? Your x-axis values will only show hours that you need.. Like this:

index=foo sourcetype=bar earliest=@d+7h latest=@d+19h | timechart span=5min dc(s) as "s"

Re: help on _time fied format on x axis

PickleRick — Mon, 07 Mar 2022 22:54:13 GMT

Example from my home splunk

As you can see, I have condition for hours 6-14 but I'm getting results from 7-15 (there is a bin command so all 14:xx times are counted as 14:00 of course) because my local timezone is CET (GMT+1)

Re: help on _time fied format on x axis

jip31 — Tue, 08 Mar 2022 06:32:12 GMT

hi somesoni

great solution thanks