topic Monthly Graph not showing proper value on X axis in Splunk Search

Monthly Graph not showing proper value on X axis

hanibans — Mon, 12 Aug 2019 11:23:04 GMT

I am creating monthly chart using splunk timechart query as shown below:

index="sample_audit_log" | timechart span=1mon dc(username) as TOTAL_USERS

In statistics tab, results are showing proper months like 2019-07, 2019-08 but in visualization line chart, months are displaying wrong date June 30, 2019 6:30 PM and July 30, 2019 6:30 PM respectively.

In Statistics Tab:

In Visualization Tab:

It is displaying wrong date for every month. Example for July month, it is showing 30th June date.

Any suggestions would really be helpful and appreciable.

Re: Monthly Graph not showing proper value on X axis

Sukisen1981 — Mon, 12 Aug 2019 16:04:37 GMT

hi @hanibans
This is weird, yet your screen shot supports your statement. Assuming you have access to the _audit index, can you please run this query as is for all time range or last 3 months and tell us if you still see the same issue?

index="_audit" | timechart span=1mon dc(action) as TOTAL_ACTIONS

Re: Monthly Graph not showing proper value on X axis

niketn — Mon, 12 Aug 2019 16:43:40 GMT

@hanibans what is the timezone of logged in user? Can you set the same to UTC and see?

Re: Monthly Graph not showing proper value on X axis

hanibans — Mon, 12 Aug 2019 19:04:42 GMT

@Sukisen1981 I am facing same issue for longer time duration. I tried running same query for 3 months and 6 months.

On Mouse hover, it is showing date of last month.

Re: Monthly Graph not showing proper value on X axis

Sukisen1981 — Mon, 12 Aug 2019 19:08:09 GMT

uhh @hanibans - check out what @niketnilay says , the reason i asked you to try this was I was doubting what niket is saying, doesn't look like an issue with search duration, try tinkering with the timezones