topic Re: How to make X axis show dates not just date field in Splunk Search

How to make X axis show dates not just date field

kirrusk — Wed, 16 Feb 2022 15:53:45 GMT

I'm trying to add a chart by using the below query, in chart lines Date is coming.
But in x-axis shows only the Date field instead of Dates.

index=_internal FIELD1=* FIELD2=* | eval Date=(_time, "%d/%m/%y") | sort Date | eval Date=(_time, "%d/%m/%y") | table Date FIELD1 FIELD2

Re: Date is not coming in x axis

ITWhisperer — Wed, 16 Feb 2022 14:16:38 GMT

What are you attempting to do?

Converting _time to a string (Date) and then sorting will sort lexicographically and given that you put day first you will get 11/2 ahead of 2/2 - is that what you intended?

The _time field is usually displayed in local format in charts etc. so perhaps you would be better off using

| table _time Field1 Field2

Re: Date is not coming in x axis

kirrusk — Wed, 16 Feb 2022 14:39:06 GMT

@ITWhisperer

I appended some data to existing data in the index, which is coming from CSV, in that date format will be like 01/12/22
so I convert _time to %d/%m/%y

Re: Date is not coming in x axis

ITWhisperer — Wed, 16 Feb 2022 14:46:26 GMT

You could try converting it the other way using strptime?

Re: Date is not coming in x axis

kirrusk — Wed, 16 Feb 2022 14:56:33 GMT

@ITWhisperer just found, using %d/%m/%y the format I can see the date in the x-axis, but only when a short time range selecting.

Re: Date is not coming in x axis

ITWhisperer — Wed, 16 Feb 2022 15:18:23 GMT

You might also want to consider rotating the label used on the x-axis so more values can be squeezed in

Re: How to make X axis show dates not just date field

kirrusk — Fri, 18 Feb 2022 09:23:20 GMT

working if browser window minimized or may be by using rotating, but my requirement change to display weekly data. So the date is populating properly.