I'm looking to create a multi-series scatter plot where time is on the x-axis.
An example would be something like this:
Attempts to do this in splunk are failing. Given the format requirements: ... | table marker_name_field x-axis_field y-axis_field
In the first attempt, using _time, all points are assigned an x-value of 0, like splunk can't understand the timestamp in its native/textual format. (see example below)
Using the timestamp in epoch format works in that it will correctly display points along the x-axis, but having a timestamp in that format is not human interpretable, so is not particular useful or viable as an option. (see example below)
Short of using D3 to create a custom viz, is there something I'm missing, or are Splunk's native viz capabilities unable to create this kind of chart?
If using time as an epoch works OK but just displays incorrectly, can you try using fieldformat to make it appear different without changing the underlying value?
| mysearch | fieldformat "_time"=strftime('_time', "%H:%M:%S")
Let us know if that works.
Good idea, but sadly that doesn't work either. On the chart, all points are assigned a value of _time=0. Would post a screenshot, but already exceeded my two img upload limit for this post.