topic Re: creating a scatterplot with time on the x-axis in Splunk Search

creating a scatterplot with time on the x-axis

pbrunel_splunk — Tue, 29 Sep 2020 13:14:39 GMT

I'm looking to create a multi-series scatter plot where time is on the x-axis.

An example would be something like this:

Attempts to do this in splunk are failing. Given the format requirements: ... | table marker_name_field x-axis_field y-axis_field

In the first attempt, using _time, all points are assigned an x-value of 0, like splunk can't understand the timestamp in its native/textual format. (see example below)

Using the timestamp in epoch format works in that it will correctly display points along the x-axis, but having a timestamp in that format is not human interpretable, so is not particular useful or viable as an option. (see example below)

Short of using D3 to create a custom viz, is there something I'm missing, or are Splunk's native viz capabilities unable to create this kind of chart?

Re: creating a scatterplot with time on the x-axis

Richfez — Wed, 15 Mar 2017 00:48:31 GMT

If using time as an epoch works OK but just displays incorrectly, can you try using fieldformat to make it appear different without changing the underlying value?

| mysearch | fieldformat "_time"=strftime('_time', "%H:%M:%S")

Let us know if that works.

Happy Splunking!
-Rich

Re: creating a scatterplot with time on the x-axis

pbrunel_splunk — Wed, 15 Mar 2017 03:21:27 GMT

Good idea, but sadly that doesn't work either. On the chart, all points are assigned a value of _time=0. Would post a screenshot, but already exceeded my two img upload limit for this post.

Re: creating a scatterplot with time on the x-axis

Anantha123 — Mon, 09 Sep 2019 15:36:28 GMT

Hi, Did you get solution for this. I am also looking something similar . I have time in both X-axis and Y-axis .
Thanks