topic Re: Formatting axis lables on a time based chart in Splunk Search

Formatting axis lables on a time based chart

tsmithsplunk — Wed, 21 Jun 2017 14:56:00 GMT

I have a search that uses timechart to show a count of certain events per day for a one month period. Nothing fancy:

index=x earliest=-30d@d ... | timechart span=1d count by threadpool

Works fine but of course it shows only about 5 X axis labels. I would prefer it show one for every day in the month. There is room for this but only if the date/time label can be reformatted. It currently shows as "Mon May 1 2017". That label is too long. So when I force a label per day using:

<option name="charting.axisLabelsX.majorUnit">P0Y0M1DT0H0M0S</option>

Now all the label text overlaps and it becomes unreadable. I can't find a way to reformat the date on a timechart (if this is possible let me know!), so how can I change my search to use "chart" and still get a data point per day per series?

Thanks!
Using v5.0.14 (I know, we're way behind. I wish I could rotate the labels but that isn't supported.)

Re: Formatting axis lables on a time based chart

cmerriman — Wed, 21 Jun 2017 15:02:11 GMT

try using chart instead of timechart, though if you're exporting a PDF, it might not export the labels. i'm adding the eval just to reformat the time if you need it, feel free to remove.

|chart span=1d count by threadpool|eval _time=strftime(_time,"%Y/%m/%d")

|bucket span=1d _time|eval _time=strftime(_time,"%Y/%m/%d")|stats count by _time threadpool

Re: Formatting axis lables on a time based chart

tsmithsplunk — Wed, 21 Jun 2017 20:11:41 GMT

Your second idea works great. Thanks.