Dashboards & Visualizations

How to eliminate x axis chart time options

joesrepsolc
Communicator

Collecting summary data into a summary index every hour. Data will only have events at 8am, 9am, 10am etc. On my timechart panel Splunk still shows 8:10, 8:20, 8:30 etc and my data bars are spaced out really far. Tried span=1h but it still displays this way. Only going to be 24 values a day for each application I chart. How can I get these bars to show closer together, use a wider bar for each value? Dont like the super skinny bar width and spacing. Thanks!

 

x_axis_change.png

Labels (1)
0 Karma

niketn
Legend

how about timechart with cont=f, for example:

<yourCurrentSearch>
| timechart count by Application cont=f 

Or use stats to plot _time like

<yourCurrentSearch>
| bin _time span=1h 
| stats count by _time Application

Both these approach will plot for only the Time for which data is present hence your chart should not have gap!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...