All Apps and Add-ons

How to show only the selected time in axis label in timeline custom visualization?

avni26
Explorer

HI,
I have searching data from only first 6 days of each month i.e for example: from 1st April to 4th April 2020
My first time value is 04/01/2020 09:20 and the latest is 04/07/2020 07:05, but in the timeline chart visualization its displaying axis label as 04/01/2020 04/07/2020 04/14/2020 ........ 05/02/2020

Is it possible to force the timeline to display the full range of only my search, or manually set the time range?
I want the timeline to always displays the values which only in time field .

Any advice and assistance is appreciated. Thanks,

0 Karma

to4kawa
Ultra Champion

sample:

| makeresults count=2
| streamstats count
| eval _time=if(count=1,relative_time(_time,"@mon"),relative_time(_time,"+1mon@mon+7d"))
| makecontinuous span=1d _time
| streamstats count as test
| streamstats count(eval(test % 6 = 1)) as session
| stats min(eval(round(_time))) as time by session
| eval time=strftime(time,"%F")
| table time session

If x-axis is text, it displays good.

0 Karma

to4kawa
Ultra Champion

alt text
my splunk

0 Karma

avni26
Explorer

@to4kawa ohh , not line chart . I am saying about timeline custom visualization.

0 Karma

to4kawa
Ultra Champion

I see, I'm sorry misunderstand.

0 Karma

avni26
Explorer

@to4kawa Thank you for your reply.
I tried to execute the above sample query , but still in Timeline visualization , axis labels showing
04/05/2020 04/12/2020 04/19/2020 04/26/2020 05/03/2020

It should display as below for above sample query
04/01/2020 04/07/2020 04/13/2020 04/19/2020 04/25/2020 05/01/2020 05/07/2020

Please suggest.

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...