Dashboards & Visualizations

timechart xaxis custom display text

thuhuongle
Explorer

Hi all,
It would be great if anyone have a solution for my timechart xaxis issue.  Thanks in advance for you time and effort.
Here is the problem:
A timechart (5 line charts) with span=30min earliest=-180d@d. _time transforms to | eval Date=strftime(Date, "%d/%m/%y %H:%M") .
Since i dont use the _time var, so timechart does not display the Xaxis time interval ( 1st pic). If i zoom in, the Xaxis tecxt will be visible( 2nd pic).
Is this possible to have xaxis time interval text ( by month 12 01 02 03 04 05 06). Because without it, user have to move the mouse to read lien chart by the tooltip box. 
restriction: I need to respect the format "%d/%m/%y %H:%M" so i could not use default _time ( which is available in SPLUNK)
1st : without zoom, need to depend on tooltip to know the Date
1st1st
2nd: zoom, xaxis lable become visible
image.png

What i looking to acheive by either ccs or SPL( dont think it is possible)
xaxis time interval text ( by month %m or %d/%m/%y %H:%M could be great)

thuhuongle_0-1624963621110.png

thanks

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...