Archive

change the time format in timechart tooltip

Explorer

How to change the time format in timechart tooltip? its in AM/PM format but i need to change to 24hr format.

Tags (1)
0 Karma

Path Finder

Do we have an answer for this yet?I am still struggling.It would be great if someone could help.

0 Karma

Champion

Hello Vaishnavi,
You have one single solution left. Use stats instead of timechart

search...|eval Time=strftime(_time,"%d-%m-%Y %T")|stats count by Time

Hoping this is what you are looking for.

Thanks

0 Karma

SplunkTrust
SplunkTrust

That happens because you lose the bucketing and the smart x-axis-labeling performed by the timechart.

The labeling is not nice to look at, but the lack of bucketing severely changes the result of your query. You can do this:

... | bucket _time | eval time = strftime(...) | chart count by time

You will still get the less-than-smart x-axis labeling. That relies on having epoch timestamps, and will automatically fall back to formatting them according to your locale.

Explorer

Thanks. Time format is changing but the dates on the x-axis look like this --> |...|...|

0 Karma

SplunkTrust
SplunkTrust

That timestamp is formatted according to your browser's locale, as seen at the front of the Splunk URL. For example, en-US will render an AM/PM time while en-GB will render a 24h time.

Explorer

I am still searching for a solution. Please help.

0 Karma

SplunkTrust
SplunkTrust

I don't know of any.

0 Karma

Explorer

is there any way to change time format in tooltip alone?

0 Karma

SplunkTrust
SplunkTrust

Renaming the _time field will indeed break the axis labels, those rely on that field and the _span field.

0 Karma

Explorer

Yeah but is it possible to change the time format? i tried changing the format of time as follows,
Mysearch | timechart avg(*) | rename _time as Time | convert timeformat="%H:%M" ctime(Time) AS Time
Time format is getting changed in tooltip but x-axis labels are not getting displayed.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!