Collecting summary data into a summary index every hour. Data will only have events at 8am, 9am, 10am etc. On my timechart panel Splunk still shows 8:10, 8:20, 8:30 etc and my data bars are spaced out really far. Tried span=1h but it still displays this way. Only going to be 24 values a day for each application I chart. How can I get these bars to show closer together, use a wider bar for each value? Dont like the super skinny bar width and spacing. Thanks!
how about timechart with cont=f, for example:
<yourCurrentSearch>
| timechart count by Application cont=f
Or use stats to plot _time like
<yourCurrentSearch>
| bin _time span=1h
| stats count by _time Application
Both these approach will plot for only the Time for which data is present hence your chart should not have gap!