Archive

creating a scatterplot with time on the x-axis

Splunk Employee
Splunk Employee

I'm looking to create a multi-series scatter plot where time is on the x-axis.

An example would be something like this:

alt text

Attempts to do this in splunk are failing. Given the format requirements: ... | table marker_name_field x-axis_field y-axis_field

In the first attempt, using _time, all points are assigned an x-value of 0, like splunk can't understand the timestamp in its native/textual format. (see example below)

Using the timestamp in epoch format works in that it will correctly display points along the x-axis, but having a timestamp in that format is not human interpretable, so is not particular useful or viable as an option. (see example below)

alt text

Short of using D3 to create a custom viz, is there something I'm missing, or are Splunk's native viz capabilities unable to create this kind of chart?

SplunkTrust
SplunkTrust

If using time as an epoch works OK but just displays incorrectly, can you try using fieldformat to make it appear different without changing the underlying value?

| mysearch | fieldformat "_time"=strftime('_time', "%H:%M:%S")

Let us know if that works.

Happy Splunking!
-Rich

0 Karma

Splunk Employee
Splunk Employee

Good idea, but sadly that doesn't work either. On the chart, all points are assigned a value of _time=0. Would post a screenshot, but already exceeded my two img upload limit for this post.

0 Karma

Communicator

Hi, Did you get solution for this. I am also looking something similar . I have time in both X-axis and Y-axis .
Thanks

0 Karma