topic Re: How to include x axis info on chart in Splunk Search

How to include x axis info on chart

kbcuait — Tue, 07 May 2013 23:05:23 GMT

Hi, I have created a results chart using this search:

| dbquery "DBNAME" "SELECT useraction FROM usertable" | eval useraction=strftime(useraction,"%Y-%d-%m") | stats count by useraction

However there are no dates along the x axis, only the title of "useraction"

How can I get those there for context?

Thanks 🙂

Re: How to include x axis info on chart

lguinn2 — Wed, 08 May 2013 05:14:03 GMT

I am not sure that this will work, but try

| dbquery "DBNAME" "SELECT useraction FROM usertable" 
| eval useraction=strftime(useraction,"%Y-%d-%m")
| eval _time=strptime(useraction,"%Y-%d-%m")
| timechart span=5m count

Hopefully, this will build a timechart with 5 minute increments. You can set the span to something else if you want, but there is a limit to the number of datapoints that can be displayed in a chart. I forget what the limit it, but you should get an error message (red bar) if you try to exceed it.

Re: How to include x axis info on chart

kbcuait — Wed, 08 May 2013 16:58:14 GMT

Hi and thanks - this gives me No results found