Specify timestamp display format for timechart axis labels

[chendry]

Hi everyone,

I want the timestamps for the X-axis labels of a timechart to have the following format:

MM-DD HH:mm

where HH:mm is in 24-h format, M designates month, m designates minute.

Example: "February 14th, 1PM" should look like "02-14 13:00"

Does anyone now how & where this can be configured?

Thanks!

[chendry]

Thanks for your replies -

The proposed method worked:

... | timechart span=1m sum(HTTP_5xx) | fillnull value=0 | rename _time AS Time | eval Time=strftime(Time, "%m-%d %H:%M")

However, using the above search command, the labels on the X-Axis disappear.

This is how chart labels looked before ("bad" timestamp formatting, but proper labels):

This is how chart labels look now (proper timestamp formatting, but labels not shown):

I use the following chart formatting option the force label visibility:

          <param name="charting.primaryAxisLabels.majorLabelVisibility">show</param>

However, with the reformatted timestamps, the labels only partly appear (i.e. they are still cut off) when stretching the chart horizontally to ~ 2000 pixels...

[chendry]

I guess the cause for this is that after using strftime(), the chart values on the X-Axis are not anymore of type TIME, but CATEGORY. Unfortunately, I think that it is not possible to properly space the major labels for a CATEGORY axis because the param "charting.axisLabelsX.majorUnit" does not seem to exist for category axis type. Does anyone know how to space category labels?

[Ron_Naken]

You can use chart to do the same as timechart:

... | eval Time = strftime(_time, "%m/%d %H:%M") | chart count as Total by Time

And it's easy to format a chart...

EDIT:

Based on gkanapathy's comment, it might be better to implement it like this to ensure proper sorting of the time values:

... | eval Time = _time | chart count as Total by Time span=1h | eval Time=strftime(Time, "%m/%d %H:%M") 

[gkanapathy]

You should do the chart/timechart, then apply a rename and eval afterwards to solve these issues.

[gkanapathy]

That won't quite work, as the Time field will not necessarily be sorted in the right order, and furthermore if the data isn't distributed evenly, your time axis won't be even over time. You can use the makecontinuous command to try to overcome the second problem.