How to format X axis label in the timechart?

[arjit]

Hi All, 

I am running a below query: 

index=xyz sourcetype=abc  | dedup _raw| timechart span=1m count 

and what I could see is that the label in the X-axis is always in the below format: 

timechart below: 

We want date parameter before the month (in AU format) which will be Tue 19 Jan 2021. 

Inspite of using Strftime or fieldformat, I am not able to change this label format.  Can anybody please help me out on this? 

@woodcock : Hi woodcock! I remember you responded to a query in a similiar lines sometime before, but I wasn't able to find that response now.. Need your inputs please !

Please do let me know in case of any queries 

Thanks 

AG.

[renjith_nair · Accepted solution]

Try ,

timechart span=1m count |convert timeformat="%a %d %m %Y %H:%M:%S" ctime(_time) AS time | fields - _time | fields time,*

[arjit]

@renjith_nair  Thanks Renjith! But I am not getting any label  in the x axis now after this query 😞 

[renjith_nair]

This is my sample search

[arjit]

@renjith_nair Thanks Renjith for this.  Yeah this is working when the time span chosen is less (say for 30 mins or so).. The problem what I am facing here is that I have to show the timechart for entire day and time span chosen is 5 mins. So what happens is if the X-axis label is long (as in this case for e.g. Tue 19 01 2021 16:50:00), it wont display it in the x - axis. But when we allow the timechart to choose default _time option, it shows the labels properly. So are you aware if there is an option to change the timechart using XML option without changing the search query?