Dashboards & Visualizations

timechart xaxis custom display text

thuhuongle
Explorer

Hi all,
It would be great if anyone have a solution for my timechart xaxis issue.  Thanks in advance for you time and effort.
Here is the problem:
A timechart (5 line charts) with span=30min earliest=-180d@d. _time transforms to | eval Date=strftime(Date, "%d/%m/%y %H:%M") .
Since i dont use the _time var, so timechart does not display the Xaxis time interval ( 1st pic). If i zoom in, the Xaxis tecxt will be visible( 2nd pic).
Is this possible to have xaxis time interval text ( by month 12 01 02 03 04 05 06). Because without it, user have to move the mouse to read lien chart by the tooltip box. 
restriction: I need to respect the format "%d/%m/%y %H:%M" so i could not use default _time ( which is available in SPLUNK)
1st : without zoom, need to depend on tooltip to know the Date
1st1st
2nd: zoom, xaxis lable become visible
image.pngimage.png

What i looking to acheive by either ccs or SPL( dont think it is possible)
xaxis time interval text ( by month %m or %d/%m/%y %H:%M could be great)

thuhuongle_0-1624963621110.pngthuhuongle_0-1624963621110.png

thanks

Labels (3)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Rounding off the Splunk Dashboard Contest

What does a contest-winning Splunk dashboard look like? In this case, it isn't in a browser tab at all. It ...

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

AI + Observability: AI Agents, LLMs, Apps, & Infrastructure The rapid evolution of artificial intelligence ...

Splunk Technical Support Is Moving to Cisco Support Tools

Introduction Splunk technical support is transitioning to Cisco’s support environment. This change brings ...