topic Re: Line chart group by month in Splunk Search

Line chart group by month

andy222 — Mon, 24 Feb 2020 21:55:42 GMT

Hi,
I am sorry I am very new to the splunk and I am struggling with the results I want to get.
I have a query that produces desired (kind of.. In visualization, months are still not in chronological order) result as bar chart without any effort. When I convert that to line chart, my grouping by month is removed and I get result for each day as seen below:

Query:

QUERY | eval Date=strftime('_time',"%Y-%m") | timechart count by Click | sort _time Desc

Visualization looks perfect as bar chart:

As soon as I select Line chart, My X-Axis displays chart by individual date and not grouped by month as seen below: 2:

Can someone please tell me how to group my data by month in a line OR any other chart?
Also how can I display my chart starting from latest?

Thanks

Re: Line chart group by month

poete — Tue, 25 Feb 2020 06:10:59 GMT

Hello @andy222,

please modify your query as follows :

QUERY |  timechart count by Click span=1mon

and find all information about span here https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Timechart and here https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Timechart#Span_options

Re: Line chart group by month

andy222 — Tue, 25 Feb 2020 14:51:18 GMT

Hi @poete,
Thanks for your answer. It worked like a charm.
Now only problem remains is that, it starts with least to greatest. I want to start my graph from current year-month and then in the past. Currently if I set time range for 365 days, it starts at February 2019 and then goes on. I want it to start with February 2020.

Thanks again
Andy