Dashboards & Visualizations

How to prevent splunk bar graph to add new data from beginning?

aahmad
Loves-to-Learn Everything

Hey,

I recently made a bar graph in Splunk that adds new data of the duration of the test. My only problem with this graph is that after 13 entries, it starts adding data from the beginning of the graph. 

 

So for example, you can see after 28th april, new data starts getting added from the beginning of the bar graph. Please refer to the diagram below.

aahmad_0-1652205572441.png

I want the new data to continuously get added at the end of the graph and erase the old data in the beginning of the graph. How can I accomplish this?

The query I am using for the existing search is below:

index="aws_dev" | eval st=strptime(startTime, "%Y-%m-%dT%H:%M:%S.%3N%Z"), et=strptime(endTime, "%Y-%m-%dT%H:%M:%S.%3N%Z") | eval st=mvindex(st,0) | eval et=mvindex(et,0) | eval diff = et - st | eval date_wday=lower(strftime(_time,"%A"))|eval date_w=strftime(_time,"%d-%b-%y %a %H:%M:%S") |where NOT (date_wday = "sunday" OR date_wday = "saturday") | chart values(diff) by date_w

 

Labels (4)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The charting is sorted by time order but since you formatted before chart, it is sorted lexicographically.

Change the time format after charting

index="aws_dev" | eval st=strptime(startTime, "%Y-%m-%dT%H:%M:%S.%3N%Z"), et=strptime(endTime, "%Y-%m-%dT%H:%M:%S.%3N%Z") | eval st=mvindex(st,0) | eval et=mvindex(et,0) | eval diff = et - st | eval date_wday=lower(strftime(_time,"%A")) |where NOT (date_wday = "sunday" OR date_wday = "saturday") | chart values(diff) by _time | eval _time=strftime(_time,"%d-%b-%y %a %H:%M:%S") | rename _time as date_w
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...