I'm using a timechart visualization as a drilldown on a dashboard where the time range is controlled by radio buttons with options of: -24h@h, -7d@d, -30d@d, -60d@d, -90d@d, -6mon@d, and -1y@d.
......
| timechart count by "Site Name"
Most everything works fine but when I switch select -6mon@d or -1y@d the timechart no longer displays the events with their actual date and instead labels all of them as the first of the month (i.e. July 1, 2023).
I imagine this is something to do with timechart's automatic grouping based on time range but is there a way to disable this and have the events displayed with their actual date?
Not only is it important for analysis purposes, I have a drilldown of this timechart that shows the specific event data but my search is dependent on the timechart returning the specific date. See search below:
........
| eval dtg=strftime($dd_earliest$, "%d %b %Y")
| where Start=dtg AND 'Site Name'="$selected_site$"
These values are set in the drilldown stanzas of the search: | timechart count by "Site Name"
<set token="selected_site">$click.name2$</set>
<eval token="dd_earliest">$click.value$</eval>
