Area Chart format timestamp

[shangshin]

Hi, I am creating an area chart to show my application's response time over the last 24 hours and each tick is the aggregrated average response time of 30 minutes

 | bucket _time span=30m | STATS avg(time_taken) BY _time

There are 2 questions:
1. Timeline on Y axis is not viewable because the original text (6/11/12 6:00:00.000 AM) is too long. How can I format it like 11AM, 2PM, etc?
2. How can I pick a different area chart color I prefer? by editting default.css?

Thanks!

[araitz · Accepted solution]

You can use the fieldformat command to reformat _time:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fieldformat

Check out the charting.seriesColors option as documented here:

http://docs.splunk.com/Documentation/Splunk/4.3/Developer/CustomChartingConfig-FontColorBrushPalette

[araitz]

Awesome! Good work.

[shangshin]

I got it working. Thanks!

[shangshin]

Thanks for the info. I found the link of the Simple XML
http://splunk:8000/en-US/app/search/TestDashboard

and also saw the advanced xml including the XML source.
http://splunk:8000/en-US/app/search/TestDashboard?showsource=1

However, the xml does have the foregroundcolor defined below. How come I still didn't see red in the area chart? Thanks!

[araitz]

OK, totally my fault for not asking, but you are using what we call Simple XML.

To exercise greater control over things like charting colors, you would need to convert your existing view to Advanced XML - see http://splunk-base.splunk.com/answers/1/how-can-i-convert-simple-view-xml-to-advanced-xml if you want to go that route.

The reason you can't just use CSS is that the chart elements are canvas objects which are styled in-line.

[shangshin]

I added the line
"0xFF0000"

but the area chart color doesn't change to red.
Any idea?

<?xml version='1.0' encoding='utf-8'?>

test


Response Time last 4 hrs

area
0xFF0000
50
true