topic Re: [Need Help] how to reverse the time scale and corresponding count in x axis from timechart. in Splunk Search

[Need Help] how to reverse the time scale and corresponding count in x axis from timechart.

cheriemilk — Thu, 22 Oct 2020 02:26:21 GMT

Hi team,

I have below query

index=*bizx_application AND sourcetype=perf_log_bizx AND AutoSaveForm OR SaveFormV2 OR SaveForm

| timechart count by SFDC useother=false limit=0

the timechart returned as below.

Screen Shot 2020-10-21 at 6.18.36 PM.png

Now I want to adjust the _time scale in x axis to display from latest to earliest which means put the latest _time and corresponding count in the left.

How should I modify my query to achieve this adjustment?

Re: [Need Help] how to reverse the time scale and corresponding count in x axis from timechart.

bowesmana — Thu, 22 Oct 2020 03:55:46 GMT

I don't think it's sensibly possible with timecharts. You can covert time to some string value, which is sorted datewise, but you will be limited on number of data points.

| timechart span=1h count | reverse | eval t=strftime(_time,"%F %T") | table t count

but it's not really what you're after

Re: [Need Help] how to reverse the time scale and corresponding count in x axis from timechart.

cheriemilk — Thu, 22 Oct 2020 08:50:41 GMT

I tried with stats and chart . but the chart doesn't reverse as expected.

baseQuery

| fieldformat _time=strftime(_time,"%Y-%m-%d %H:%M:%S")

| bin span=2h _time

| stats count by _time SFDC

| chart values(count) by _time, SFDC

| reverse

Re: [Need Help] how to reverse the time scale and corresponding count in x axis from timechart.

ITWhisperer — Thu, 22 Oct 2020 09:29:27 GMT

It appears that chart will order time earliest to latest. The closest I have got is this

baseQuery ``` new time as number of second until next hour ``` | eval time=relative_time(relative_time(now(),"@h")+3600-_time,"@h") ``` 2 hour bins using new time ``` | bin span=2h time ``` stats using new time ``` | stats count by time SFDC ``` reformat new time for display purposes ``` | fieldformat time=strftime(relative_time(now(),"@h")+3600-time,"%Y-%m-%d %H:%M") ``` new time as x-axis, count as y-axis, SFDC series ``` | xyseries time, SFDC, count

The problem with this is that the values on the x-axis are not displayed nicely.

Re: [Need Help] how to reverse the time scale and corresponding count in x axis from timechart.

cheriemilk — Thu, 22 Oct 2020 13:23:03 GMT

Hi @ITWhisperer

there's no direct way to reverse the time order in timechart, right?

Re: [Need Help] how to reverse the time scale and corresponding count in x axis from timechart.

cheriemilk — Mon, 26 Oct 2020 06:43:18 GMT

@ITWhisperer

I found this way works:

| bin span=2h _time

| stats count as number by _time SFDC

| eval Time=strftime(_time,"%Y/%m/%d %H:%M")

| chart values(number) by Time SFDC limit=0 useother=f

| reverse

Re: [Need Help] how to reverse the time scale and corresponding count in x axis from timechart.

ITWhisperer — Mon, 26 Oct 2020 09:07:03 GMT

@cheriemilk

It seems to work with rename as well

Although you might still need to format the field if that's important to you

Re: [Need Help] how to reverse the time scale and corresponding count in x axis from timechart.

cheriemilk — Tue, 27 Oct 2020 06:05:31 GMT

@ITWhisperer Thanks.