topic Re: Timechart x-axis customized time in Splunk Search

Timechart x-axis customized time

abhi144 — Tue, 08 Apr 2014 12:08:59 GMT

I am getting date from my device in search date field like date=20140408045219. So i wanted to show the time chart according to date field in x-axis not _time. Any suggestion will be helpful?

Re: Timechart x-axis customized time

martin_mueller — Tue, 08 Apr 2014 13:34:48 GMT

You might be able to do something like this:

base search | eval _time = strptime(date, "%Y%m%d%H%M%S") | timechart ...

However, do consider if it makes sense to use that date field as the actual _time value when indexing future data.

Re: Timechart x-axis customized time

abhi144 — Tue, 08 Apr 2014 13:45:36 GMT

Thanks for your suggestion martin. But it still taking _time on x-axis its not taking my time which is coming through eval _time = strptime(date, "%Y%m%d%H%M%S").

Re: Timechart x-axis customized time

martin_mueller — Tue, 08 Apr 2014 13:50:39 GMT

When I run this over here:

index=_internal | head 1 | eval date="20140408045219" | eval _time = strptime(date, "%Y%m%d%H%M%S") | timechart count

I get a blip at 4:52AM rather than now (3:50PM).

It's still using the field called _time, but with the value you've changed it to.

Re: Timechart x-axis customized time

HMTODD — Thu, 03 Nov 2016 15:57:47 GMT

You may want to try the chart command. "Unlike the timechart command which generates a chart with the _time field as the x-axis, the chart command produces a table with an arbitrary field as the x-axis."