Dashboards & Visualizations

timechart xaxis custom display text

thuhuongle
Explorer

Hi all,
It would be great if anyone have a solution for my timechart xaxis issue.  Thanks in advance for you time and effort.
Here is the problem:
A timechart (5 line charts) with span=30min earliest=-180d@d. _time transforms to | eval Date=strftime(Date, "%d/%m/%y %H:%M") .
Since i dont use the _time var, so timechart does not display the Xaxis time interval ( 1st pic). If i zoom in, the Xaxis tecxt will be visible( 2nd pic).
Is this possible to have xaxis time interval text ( by month 12 01 02 03 04 05 06). Because without it, user have to move the mouse to read lien chart by the tooltip box. 
restriction: I need to respect the format "%d/%m/%y %H:%M" so i could not use default _time ( which is available in SPLUNK)
1st : without zoom, need to depend on tooltip to know the Date
1st1st
2nd: zoom, xaxis lable become visible
image.png

What i looking to acheive by either ccs or SPL( dont think it is possible)
xaxis time interval text ( by month %m or %d/%m/%y %H:%M could be great)

thuhuongle_0-1624963621110.png

thanks

Labels (3)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Observability Simplified: Combining User Experience, Application Performance & ...

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network ...

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...

Global Splunk User Group Events: May + June 2026

Your Splunk Community Awaits: Discover Upcoming User Group Events Worldwide    Staying ahead in the fast-paced ...