topic Re: How to change timechart axis in Splunk Search

How to change timechart axis?

corehan — Tue, 19 Apr 2022 15:57:03 GMT

Hello dears,

How can i change timechart _time axis y to x ?

<base search> | timechart span=1h sum(REQUESTNAME) as Sikayet count by ilce |sort -count | untable _time Xaxis Yaxis |where Yaxis > 3

Regards

Re: How to change timechart axis

VatsalJagani — Tue, 19 Apr 2022 13:52:35 GMT

@corehan - Why you are using untable command?

By default timechart command put _time on the X-axis. Please try removing stuff after sort command and see if you get what you need.

-----
I hope this helps!!! If it does consider upvoting!!!

Re: How to change timechart axis

corehan — Tue, 19 Apr 2022 13:59:35 GMT

Thank you for suggest but i can't found, how can i put the _time to x axis command..

Regards.

Final search;

<base search> | timechart span=1h count(REQUESTNAME) by ilce |sort -count

Also i need to set threshold value like count >3 in this scenario.

Re: How to change timechart axis

VatsalJagani — Tue, 19 Apr 2022 14:11:15 GMT

@corehan - Since you are using timechart command with groupby, your Y-axis field name is not the "count".

If you look at the results it's not one-dimensional results here. So if you want to filter for those for which the total count is not greater than 3 then you can use the following search:

Please post the screenshot of the result if this does not work.

Re: How to change timechart axis

ITWhisperer — Tue, 19 Apr 2022 14:12:03 GMT

| xyseries Xaxis _time Yaxis

Re: How to change timechart axis

corehan — Tue, 19 Apr 2022 15:52:43 GMT

Hello,

I changed the query but i doesn't work;

Re: How to change timechart axis?

corehan — Mon, 25 Apr 2022 10:24:57 GMT

Finally here is my query which i want;

Fyi..