topic Center _time on a column chart in Splunk Search

Center _time on a column chart

incognito — Wed, 15 Dec 2021 13:21:46 GMT

Hello,

I would like to center the dates of my timechart (column) :

I'm using the timechart command in order to get a table that is then transformed in a column chart.

How can I do this?

Thank you.

Best regards,

Re: Center _time on a column chart

ITWhisperer — Thu, 16 Dec 2021 08:34:26 GMT

The times created by timechart represent the start of the period / span so aligning to the axis marker makes sense i.e. the anchor for the label is to the left and the data at this point in the chart is no earlier than the value of the label. There is no anchor point in the middle of the bar in the barchart with which to align the text even if you wanted to. You might be able to hack around this by formatting the time (strftime) with leading spaces, however, you may find that the chart viz will strip leading/trailing spaces before displaying the x-axis label anyway.