Dashboards & Visualizations

Displaying date with timewrap command?

Kk
Path Finder

Hi All, Is there any way to display the date in visualization by using timewrap.

 Ex:

22/09/10,22/09/09,22/09/08..etc.-->Expecting

1day ago, 2days ago, 3days ago   ---> Actual o/p

 

Please help me out, If you got any idea on this

 

Thanks,

kk

 

 

Labels (5)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

See the 'series=exact' and time_format option in the documentation

| timewrap series=exact time_format="%d-%m-%Y" 1d

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

It's not clear what you are asking - do you have a problem using the timewrap command?

The documentation gives examples of how to use timewrap

https://docs.splunk.com/Documentation/Splunk/8.2.7/SearchReference/Timewrap

What sort of visualisation do you want?

Kk
Path Finder

Suppose think my query is in this way.

index=temp "error" earliest=-3d@d latest=now|timechart count|timewrap d

Result:

I will be showing the count in line chart. Where it list down the peaks of error count with respect to 24hrs of time and in the right side it will show options to select the 1dayago data,2dataago,3 days ago..

So my question is, there is any way to show the date rather than showing date like this 1dayago data,2dataago,3 days ago. I was expecting date like this, Example today is 09-11-2022, so the data on right side of line chart will be 08-11-2022, 07-11-2022, 06-11-2022..

That's it. 

 

 

 

 

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

See the 'series=exact' and time_format option in the documentation

| timewrap series=exact time_format="%d-%m-%Y" 1d

 

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...