topic Re: Changing timechart X axis in Splunk Search

Changing timechart X axis

appleman — Thu, 26 Dec 2013 07:25:07 GMT

Hello,

I want to change X axis on timechart, so I created a dashboard, and added the following option.

My search: index=test sourcetype=type | timechart span=5m sum(A) as A sum(B) as B sum(C) as C sum(D) as D

1
P0Y0M0DT2H0M0S

However, X axis still follows the splunk default auto settings which is 6hours or 4hours.
What else do I need to add on this dashboard to change X axis?

Thank you.

タイムチャートコマンドを利用したサーチで、縦棒グラフをダッシュボードに作成したのですが、下記の設定を加えてもX軸が上手く設定変更されません。
これ以外に何か加える設定等はございますでしょうか。

サーチ文：index=test sourcetype=type | timechart span=5m sum(A) as A sum(B) as B sum(C) as C sum(D) as D

1
P0Y0M0DT2H0M0S

Re: Changing timechart X axis

somesoni2 — Thu, 26 Dec 2013 12:54:21 GMT

Have look at this post, which has similar requirements...
http://answers.splunk.com/answers/109435/timechart-x-axis-tick-marks-every-month?page=1&focusedAnswerId=109487#109487

Re: Changing timechart X axis

appleman — Fri, 27 Dec 2013 03:29:17 GMT

Thank you for sharing.
I've converted my simple xml to advanced, but it didn't work.

Re: Changing timechart X axis

melonman — Thu, 27 Feb 2014 13:28:54 GMT

How about this?

index=_internal earliest=-24h@h latest=@h component="Metrics" group="tpool" 
| bucket _time span=1h 
| stats max(workers) as A avg(workers) as B  median(workers) as C stdev(workers) as D by _time 
| rename _time as time 
| eval time=strftime(time, "%Y/%m/%d %H:%M")