Dashboards & Visualizations

How to customize X Axis in time chart?

kell_cena
Explorer

Hi All,

I want chart to be created in the below way. The x-axis needs to have date and time like that.

kell_cena_0-1679412889656.png

the chart i am able to create is .

kell_cena_1-1679412932257.png


i tried to do eval strftime to _time but not getting the desired result.

The 1st query I tried - 

index=unix (source=cpu sourcetype=cpu) OR (sourcetype=vmstat) host IN (usaws135000)
| fields _time cpu_load_percent memUsedPct swapUsedPct host
| timechart span=1h eval(round(avg(cpu_load_percent),2)) as CPUAvg eval(round(avg(memUsedPct),2)) as MemoryAvg eval(round(avg(swapUsedPct),2)) as SwapAvg by host useother=t limit=0


The 2nd query i tried - 

index=unix (source=cpu sourcetype=cpu) OR (sourcetype=vmstat) host IN (usaws1350)
| fields _time cpu_load_percent memUsedPct swapUsedPct host
| bin span=1h _time
| eval _time=strftime(_time,"%a %b %d %Y %H:%M:%S")
| stats avg(cpu_load_percent) as CPUAvg avg(memUsedPct) as MemoryAvg avg(swapUsedPct) as SwapAvg by _time

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Once you've created the chart, click on the Format icon then switch to the X-Axis tab where you specify the label rotation.  Or you can do so in Simple XML

<option name="charting.axisLabelsX.majorLabelStyle.rotation">-90</option>

You may be able to change the time format using the fieldformat command.

index=unix (source=cpu sourcetype=cpu) OR (sourcetype=vmstat) host IN (usaws135000)
| fields _time cpu_load_percent memUsedPct swapUsedPct host
| timechart span=1h eval(round(avg(cpu_load_percent),2)) as CPUAvg eval(round(avg(memUsedPct),2)) as MemoryAvg eval(round(avg(swapUsedPct),2)) as SwapAvg by host useother=t limit=0
| fieldformat _time=strftime(_time, "%m/%d/%Y %H:%M:%S")

I'm not sure if it's possible to display as many labels as in your example, but this might do it.

<option name="charting.axisLabelsX.majorLabelVisibility">show</option>

The default of "auto" selectively hides labels to improve readability.

See https://docs.splunk.com/Documentation/Splunk/9.0.4/Viz/ChartConfigurationReference#Area.2C_Bubble.2C... for more

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Once you've created the chart, click on the Format icon then switch to the X-Axis tab where you specify the label rotation.  Or you can do so in Simple XML

<option name="charting.axisLabelsX.majorLabelStyle.rotation">-90</option>

You may be able to change the time format using the fieldformat command.

index=unix (source=cpu sourcetype=cpu) OR (sourcetype=vmstat) host IN (usaws135000)
| fields _time cpu_load_percent memUsedPct swapUsedPct host
| timechart span=1h eval(round(avg(cpu_load_percent),2)) as CPUAvg eval(round(avg(memUsedPct),2)) as MemoryAvg eval(round(avg(swapUsedPct),2)) as SwapAvg by host useother=t limit=0
| fieldformat _time=strftime(_time, "%m/%d/%Y %H:%M:%S")

I'm not sure if it's possible to display as many labels as in your example, but this might do it.

<option name="charting.axisLabelsX.majorLabelVisibility">show</option>

The default of "auto" selectively hides labels to improve readability.

See https://docs.splunk.com/Documentation/Splunk/9.0.4/Viz/ChartConfigurationReference#Area.2C_Bubble.2C... for more

 

---
If this reply helps you, Karma would be appreciated.

kell_cena
Explorer

Thank you @richgalloway for your answer and the reference link. Much appreciated .

Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...