topic Re: change the time format in timechart tooltip in Splunk Search

change the time format in timechart tooltip

vaishnavi07 — Sat, 29 Mar 2014 09:39:36 GMT

How to change the time format in timechart tooltip? its in AM/PM format but i need to change to 24hr format.

Re: change the time format in timechart tooltip

martin_mueller — Sat, 29 Mar 2014 10:14:14 GMT

That timestamp is formatted according to your browser's locale, as seen at the front of the Splunk URL. For example, en-US will render an AM/PM time while en-GB will render a 24h time.

Re: change the time format in timechart tooltip

vaishnavi07 — Sat, 29 Mar 2014 14:36:13 GMT

Yeah but is it possible to change the time format? i tried changing the format of time as follows,
Mysearch | timechart avg(*) | rename _time as Time | convert timeformat="%H:%M" ctime(Time) AS Time
Time format is getting changed in tooltip but x-axis labels are not getting displayed.

Re: change the time format in timechart tooltip

martin_mueller — Sat, 29 Mar 2014 16:20:45 GMT

Renaming the _time field will indeed break the axis labels, those rely on that field and the _span field.

Re: change the time format in timechart tooltip

vaishnavi07 — Sat, 29 Mar 2014 16:30:26 GMT

is there any way to change time format in tooltip alone?

Re: change the time format in timechart tooltip

martin_mueller — Sat, 29 Mar 2014 16:40:38 GMT

I don't know of any.

Re: change the time format in timechart tooltip

vaishnavi07 — Sun, 30 Mar 2014 09:01:35 GMT

I am still searching for a solution. Please help.

Re: change the time format in timechart tooltip

linu1988 — Sun, 30 Mar 2014 14:04:23 GMT

Hello Vaishnavi,
You have one single solution left. Use stats instead of timechart

search...|eval Time=strftime(_time,"%d-%m-%Y %T")|stats count by Time

Hoping this is what you are looking for.

Thanks

Re: change the time format in timechart tooltip

vaishnavi07 — Mon, 31 Mar 2014 08:54:52 GMT

Thanks. Time format is changing but the dates on the x-axis look like this --> |...|...|

Re: change the time format in timechart tooltip

martin_mueller — Mon, 31 Mar 2014 09:04:35 GMT

That happens because you lose the bucketing and the smart x-axis-labeling performed by the timechart.

The labeling is not nice to look at, but the lack of bucketing severely changes the result of your query. You can do this:

... | bucket _time | eval time = strftime(...) | chart count by time

You will still get the less-than-smart x-axis labeling. That relies on having epoch timestamps, and will automatically fall back to formatting them according to your locale.

Re: change the time format in timechart tooltip

architkhanna — Thu, 08 Jun 2017 06:15:00 GMT

Do we have an answer for this yet?I am still struggling.It would be great if someone could help.