Dashboards & Visualizations

How to eliminate x axis chart time options


Collecting summary data into a summary index every hour. Data will only have events at 8am, 9am, 10am etc. On my timechart panel Splunk still shows 8:10, 8:20, 8:30 etc and my data bars are spaced out really far. Tried span=1h but it still displays this way. Only going to be 24 values a day for each application I chart. How can I get these bars to show closer together, use a wider bar for each value? Dont like the super skinny bar width and spacing. Thanks!



Labels (1)
0 Karma


how about timechart with cont=f, for example:

| timechart count by Application cont=f 

Or use stats to plot _time like

| bin _time span=1h 
| stats count by _time Application

Both these approach will plot for only the Time for which data is present hence your chart should not have gap!

| makeresults | eval message= "Happy Splunking!!!"
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!