topic Re: How to set x-axis time intervals for a line chart? in Splunk Search

How to set x-axis time intervals for a line chart?

AzySidhe — Tue, 29 Sep 2020 08:58:13 GMT

I've read over all of the other variations of this question, but I haven't been able to make this work.

I have a search that runs for the Last 7 days that checks for events between 08:30 and 17:30 and then charts out a numerical value known as 'capture_value'. The end goal is to have each date as its own line along the same time frame. The time value that is used is a field in the log file rather than _time, however, I have been able to modify the search to use strftime(_time, "%H:%M:%S") and it works just the same. As the data comes in 5 minute increments, there are too many data points to display along the x-axis.

Is it possible to change this to be every hour or 30 minutes? I have tried to make this work with a timechart, but it doesn't give the results broken down by date over time like I want.

host=production source=madeup_source.csv (capture_time >= "08:30:00" AND capture_time <= "17:30:00") | chart values(capture_value) as COUNT by capture_time, capture_date useother=f limit=0

Re: How to set x-axis time intervals for a line chart?

woodcock — Wed, 02 Mar 2016 02:15:38 GMT

I do not understand. Are you saying that you would like each line on the line graph to represent a day (e.g. "today", "yesterday", "today-2", etc.) If you will mock up a picture then I am sure that I can help you do this. Your description is unclear to me.

Re: How to set x-axis time intervals for a line chart?

0YAoNnmRmKDg — Wed, 02 Mar 2016 02:23:09 GMT

have you tried

my awesome search | timechart span=30m count foo blah blah

span=30m will force Splunk to break into 30 minute segments

is that what you mean?

Re: How to set x-axis time intervals for a line chart?

AzySidhe — Sun, 06 Mar 2016 07:05:59 GMT

Close, but not quite. I have tried that and while it does break it down, the x-axis remains the full 7 days instead of the 8:30 - 17:30

Re: How to set x-axis time intervals for a line chart?

AzySidhe — Sun, 06 Mar 2016 07:19:13 GMT

I've added a picture of what I'm currently seeing. What I would like to see along the X-axis is hourly increments from 8:30 - 17:30 but I can't make it show. The data points are every 5 minutes which results in Splunk turning the labels off by default.

Re: How to set x-axis time intervals for a line chart?

woodcock — Sat, 02 Apr 2016 21:32:40 GMT

Try this:

 host=production source=madeup_source.csv (capture_time >= "08:30:00" AND capture_time <= "17:30:00") 
| eval pretend_everything_happened_today = capture_time . " " . strftime(now(), "%Y-%m-%d")
| eval _time = strptime(pretend_everything_happened_today , "%Y-%m-%d &H:%M:%S")
| timechart span=5m avg(capture_value) AS COUNT BY capture_date

Re: How to set x-axis time intervals for a line chart?

AzySidhe — Mon, 04 Apr 2016 19:35:21 GMT

Thank you so much! This set me on the right path! I had to modify the strptime a little as the date format was swapped (it needed to be "%H:%M:%S %Y-%m-%d") but this worked!