i want to create a line chart which contain same label for x-axis for 3 values. suppose x-axis has label named Day. this line chart has three data values for same Day 11-02-2015 . Now for all the three data values its showing the labbel 11-020-2015 three times on the X-axis. But i want this to show only one time for all the three data values. How to do that
Check out the timewrap app. This will give you a timechart over a 24 hour period with different color lines relative to the day.
Once you download the Splunk timewrap app and install it then restart your Splunk server, you can then pipe your search into timewrap
Below is an example of a timewrap search I run.. You set the timeframe which shows how far you want to go back in time (-2d@d) and you pipe everything into timewrap then put d/w/m/y depending on what units of time you want
index=unleashed Call="CreateOrder" earliest=-2d@d | timechart count by Call | timewrap d
You have not even shows us your base search; how are we supposed to answer? What you are describing is highly-irregular behavior for Splunk and I'm not sure how you have gotten it to do what you are describing (which I agree, is undesirable).