topic Re: Change timechart x-axis to quarters in Dashboards & Visualizations

Change timechart x-axis to quarters?

POR160893 — Wed, 01 Mar 2023 15:14:10 GMT

Hi,

I have a timechart and the timeline on the X-axis must be in terms of quarters, i.e. like FY24Q1, FY24 Q2 etc.

Currently, this is my query:
(BASE SEARCH) | timechart span=1q count | eval Quarter=strftime(_time,"%Y") . "Q" . ceil((strftime(_time,"%m")+1)/3) | rename count as "Event Count" | fields Quarter, "Event Count"

However, I am receiving the following error:
Error in 'eval' command: Type checking failed. '+' only takes two strings or two numbers.

What can I do to solve this?

Thanks as always!

Re: Change timechart x-axis to quarters

richgalloway — Wed, 01 Mar 2023 14:51:54 GMT

The strftime function returns a string. The error is complaining that eval can't add a number to a string. Try this to convert the strftime output to a number.

| eval Quarter=strftime(_time,"%Y") . "Q" . ceil(tonumber(strftime(_time,"%m")))+1/3)

Re: Change timechart x-axis to quarters

POR160893 — Wed, 01 Mar 2023 14:25:26 GMT

When I used your suggestion as follows:
[BASE SEARCH]
| timechart span=1q count
| eval Quarter=strftime(_time,"%Y") . "Q" . ceil(tonumber(strftime(_time,"%m"))+1)/3)
| rename count as "Event Count" | fields Quarter, "Event Count",

I receive the following error:
Error in 'eval' command: The expression is malformed.

What can I do?

Re: Change timechart x-axis to quarters

richgalloway — Wed, 01 Mar 2023 14:52:29 GMT

I misplaced a parenthesis. Please try my revised answer.

Re: Change timechart x-axis to quarters

POR160893 — Wed, 01 Mar 2023 15:08:27 GMT

So, at the moment, your updated query gives me this:

The above query is as follows:
[BASE SEARCH]
| timechart span=1q count
| eval Quarter=strftime(_time,"%Y") . "Q" . ceil((tonumber(strftime(_time,"%m")))+1/3)
| rename count as "Event Count" | fields Quarter, "Event Count"

However, I need the individual days to be show WITH what ever quarter the day falls in.. So one timeline whose Year/Month/date and an overarching time to show what Quarter it falls.
Is this possible?

Re: Change timechart x-axis to quarters

richgalloway — Wed, 01 Mar 2023 15:22:52 GMT

Timecharts support a single timeline on the X-axis. Consider filing an enhancement request at https://ideas.splunk.com

Another thing to consider is using annotations to denote the quarters. An annotation is a vertical line in the graph that marks when something happened. It's not exactly what you're looking for, but may help. See https://docs.splunk.com/Documentation/Splunk/9.0.4/Viz/ChartEventAnnotations for more information.