Timechart over 1 year displays all events on 1st of month

michaeler — Thu, 27 Jul 2023 16:03:33 GMT

I'm using a timechart visualization as a drilldown on a dashboard where the time range is controlled by radio buttons with options of: -24h@h, -7d@d, -30d@d, -60d@d, -90d@d, -6mon@d, and -1y@d.

......
| timechart count by "Site Name"

Most everything works fine but when I switch select -6mon@d or -1y@d the timechart no longer displays the events with their actual date and instead labels all of them as the first of the month (i.e. July 1, 2023).

I imagine this is something to do with timechart's automatic grouping based on time range but is there a way to disable this and have the events displayed with their actual date?

Not only is it important for analysis purposes, I have a drilldown of this timechart that shows the specific event data but my search is dependent on the timechart returning the specific date. See search below:

........
| eval dtg=strftime($dd_earliest$, "%d %b %Y")
| where Start=dtg AND 'Site Name'="$selected_site$"

These values are set in the drilldown stanzas of the search: | timechart count by "Site Name"

<set token="selected_site">$click.name2$</set>
<eval token="dd_earliest">$click.value$</eval>

Re: Timechart over 1 year displays all events on 1st of month

michaeler — Thu, 27 Jul 2023 16:19:53 GMT

Nevermind. I must have been having a brainfart and forgot about the "span" option in timechart. Fixed my own issue.

.....
| timechart span=1d count by "Site Name"

topic Timechart over 1 year displays all events on 1st of month in Dashboards & Visualizations

Timechart over 1 year displays all events on 1st of month

Re: Timechart over 1 year displays all events on 1st of month