https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-bubble-chart-with-dates-shown/m-p/278126#M83948 <P>I have a search that returns me 3 fields (let's say country, _time, count)</P> <P>I want to show these results in a bubble chart but the X axis (_time) instead of returning dates, it returns 0, 1, 2, 3 etc - it's as if instead of taking the actual date it is taking the line number where the _time field is populated and using that.</P> <P>I've been playing with date formats and other options but it makes no difference.</P> <P>Hopefully one of you Splunk gurus can put me out of my misery and let me know what I'm doing wrong!</P> Mon, 06 Feb 2017 13:18:40 GMT andyp54 2017-02-06T13:18:40Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-bubble-chart-with-dates-shown/m-p/278126#M83948 <P>I have a search that returns me 3 fields (let's say country, _time, count)</P> <P>I want to show these results in a bubble chart but the X axis (_time) instead of returning dates, it returns 0, 1, 2, 3 etc - it's as if instead of taking the actual date it is taking the line number where the _time field is populated and using that.</P> <P>I've been playing with date formats and other options but it makes no difference.</P> <P>Hopefully one of you Splunk gurus can put me out of my misery and let me know what I'm doing wrong!</P> Mon, 06 Feb 2017 13:18:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-bubble-chart-with-dates-shown/m-p/278126#M83948 andyp54 2017-02-06T13:18:40Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-bubble-chart-with-dates-shown/m-p/278127#M83949 <P>Can you share your search?<BR /> Bye.<BR /> Giuseppe</P> Mon, 06 Feb 2017 13:56:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-bubble-chart-with-dates-shown/m-p/278127#M83949 gcusello 2017-02-06T13:56:29Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-bubble-chart-with-dates-shown/m-p/278128#M83950 <PRE><CODE>index=?? sourcetype=?? country=* | bucket _time span=1d | stats count by country, _time, EventCode (span of 30 days) </CODE></PRE> <P>replaced my real index &amp; sourcetype with ?? above but the query works in real life.</P> <P>I get a nice stats page with results grouped by day but my over in visualizations &gt; bubble chart my X axis (_time) goes from 0 - 58)</P> <P>Thanks Giuseppe!</P> Mon, 06 Feb 2017 14:06:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-bubble-chart-with-dates-shown/m-p/278128#M83950 andyp54 2017-02-06T14:06:41Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-bubble-chart-with-dates-shown/m-p/278129#M83951 <P>Hi andyp54,<BR /> if you see in the Dashboard example Bubblechart (see <A href="https://splunkbase.splunk.com/app/1603/">https://splunkbase.splunk.com/app/1603/</A>) with the bubblechart graph you can use only two parameters (your have three: country, _time, EventCode!).<BR /> Bye.<BR /> Giuseppe</P> Mon, 06 Feb 2017 14:16:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-bubble-chart-with-dates-shown/m-p/278129#M83951 gcusello 2017-02-06T14:16:38Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-bubble-chart-with-dates-shown/m-p/278130#M83952 <P>Use bin to turn the _time field into dates/days.</P> <PRE><CODE>| bin _time as MyDate span=1d | table country, MyDate, count </CODE></PRE> <P>Sounds like currently it's presenting as minutes or something. </P> Mon, 06 Feb 2017 14:50:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-bubble-chart-with-dates-shown/m-p/278130#M83952 DalJeanis 2017-02-06T14:50:08Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-bubble-chart-with-dates-shown/m-p/278131#M83953 <P>Actually, by definition of a bubble chart, it's three - X value, Y value, and size of the bubble. The splunk bubble chart also allows a fourth, using a different color for different series. </P> <P><A href="https://docs.splunk.com/Documentation/Splunk/6.5.2/Viz/BubbleChart">https://docs.splunk.com/Documentation/Splunk/6.5.2/Viz/BubbleChart</A></P> Mon, 06 Feb 2017 14:53:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-bubble-chart-with-dates-shown/m-p/278131#M83953 DalJeanis 2017-02-06T14:53:35Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-bubble-chart-with-dates-shown/m-p/278132#M83954 <P>Hi DalJeanis - this gets me a bit closer; my _time Axis (now MyDate) now shows epoch time</P> <P>...the only problem is if I use a convert or eval time=strftime to make the date more readable the info is no longer passed to the chart.</P> <P>The date is showing correctly in the data under the chart but if I hover over a bubble inside the chart MyDate shows as 0</P> Mon, 06 Feb 2017 15:17:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-bubble-chart-with-dates-shown/m-p/278132#M83954 andyp54 2017-02-06T15:17:37Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-bubble-chart-with-dates-shown/m-p/278133#M83955 <P>what happens if you do this?</P> <PRE><CODE> | bin _time span=1d | table country, _time, count </CODE></PRE> Mon, 06 Feb 2017 22:34:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-bubble-chart-with-dates-shown/m-p/278133#M83955 DalJeanis 2017-02-06T22:34:15Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-bubble-chart-with-dates-shown/m-p/278134#M83956 <P>If I change it then it puts me back to my X axis showing 1, 2, 3 , 4 rather than epoch time....</P> Tue, 07 Feb 2017 10:03:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-bubble-chart-with-dates-shown/m-p/278134#M83956 andyp54 2017-02-07T10:03:20Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-bubble-chart-with-dates-shown/m-p/278135#M83957 <P>I'm going to assume it's got something to do with the bubble chart needing a stats command to generate the fields it uses.....that must mess up whatever exists in the _time field so it doesn't display. I'll play some more but this may be one of those "you can't do it" moments....</P> Tue, 07 Feb 2017 10:32:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-bubble-chart-with-dates-shown/m-p/278135#M83957 andyp54 2017-02-07T10:32:44Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-bubble-chart-with-dates-shown/m-p/278136#M83958 <P>If you add an ID to the panel "bubblechart", then add this as a script to the dashboard, it'll re-write the epoch time strings to a date format. Verified working on Splunk 6.4.4.</P> <PRE><CODE>require(['jquery', 'splunkjs/mvc/simplexml/ready!'], function($) { setTimeout(function(){ $('#bubblechart').find('.highcharts-xaxis-labels').children('text').each(function(){ var epochtime = parseInt($(this).html().replace(/\,/g,''),10); var objDate = new Date(epochtime*1000); $(this).html(objDate.toLocaleDateString('en-US')); }); }, 1000); }); </CODE></PRE> Wed, 07 Jun 2017 21:43:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-bubble-chart-with-dates-shown/m-p/278136#M83958 paulstout 2017-06-07T21:43:08Z