topic How to replace label "_time" with "time" coming in timecharts ? in Splunk Search

How to replace label "_time" with "time" coming in timecharts ?

ranjyotiprakash — Mon, 28 Sep 2020 13:00:09 GMT

I have used timecharts in splunk app. But, in all the time-charts, When mouseover the time-chart, the info it is showing in the black box comes with "_time" label for time. I want to know how to replace the _time with time label.

enter code here
<view template="dashboard.html" stylesheet="dashboard.css">

Overall Summary

*
False
1

dashboard

True
uname_setting
Unit Name :
test search

unit_name
unit_name

uname_setting

stringreplace

$target$

Last 60 minutes
True

sourcetype="access" |TR_unitname|where unit_name = "$unit_name$"| eval bandwidth=round(bytes_sent/1024,2)| timechart sum(bandwidth) | rename sum(bandwidth) AS "Bandwidth Consumed (in KB)"

Traffic Over Time
line
zero
Time
Bandwidth(in KB)
bottom

100%
360px

flashtimeline
true

    <module name="HiddenSearch" layoutPanel="panel_row2_col2" autoRun="True">
            <param name="search">sourcetype="firewall" Attack_Description!="NULL" |`WF_unitname`| where unit_name = "$unit_name$" | timechart count by Attack_Description</param>
            <module name="JobProgressIndicator"/>
            <module name="HiddenChartFormatter">
                    <param name="chartTitle">Attacks Over Time</param>
                    <param name="chart">column</param>
                    <param name="chart.stackMode">stacked</param>
                    <param name="primaryAxisTitle.text">Time</param>
                    <param name="secondaryAxisTitle.text">Count of Attacks</param>
                    <param name="legend.placement">bottom</param>
                    <module name="FlashChart">
                            <param name="width">100%</param>
                            <param name="height">360px</param>
                            <module name="ConvertToDrilldownSearch">
                                    <module name="ViewRedirector">
                                            <param name="viewTarget">flashtimeline</param>
                                            <param name="popup">true</param>
                                    </module>
                            </module>
                    </module>
            </module>
    </module>

I don't know how this _time is coming. I want to replace this _time with time.

Thanks !

Re: How to replace label "_time" with "time" coming in timecharts ?

Drainy — Fri, 21 Dec 2012 10:17:11 GMT

Just add a |rename _time as time to the end of your search string

Re: How to replace label "_time" with "time" coming in timecharts ?

ranjyotiprakash — Fri, 21 Dec 2012 10:22:10 GMT

Hi Drainy,

Piping "rename _time As time" changes the time format and then it's coming as unix Time
like 1355423400 in the chart.

Thanks

Re: How to replace label "_time" with "time" coming in timecharts ?

Drainy — Fri, 21 Dec 2012 10:26:10 GMT

add another | convert ctime(time) to the end 🙂

Re: How to replace label "_time" with "time" coming in timecharts ?

smolcj — Fri, 21 Dec 2012 10:39:15 GMT

|convert ctime(_time) as time

Re: How to replace label "_time" with "time" coming in timecharts ?

ranjyotiprakash — Fri, 21 Dec 2012 10:47:09 GMT

It's doing the change but changes the time and date format. But, I want to know why by default it is coming as _time on all the charts. But, when I create a report from the splunkweb UI it's coming as time ?
Thanks !

Re: How to replace label "_time" with "time" coming in timecharts ?

ranjyotiprakash — Fri, 21 Dec 2012 11:03:14 GMT

hi smolcj,
the search you mentioned in the comment doesn't work at all.

Thanks for reply