Changing the time intervals on the X-axis in report builder

[srw46]

Hello again,

I'm creating a chart via report builder that spans 24 hours. The labelled times are in 4 hours jumps. i.e. 12:00, 16:00, 20:00, 00:00 etc.

Is it possible to alter these and make them more frequent? Like 12:00, 01:00, 02:00 for example?

Hope this makes sense.

Thank you

[carymapa]

I have the same problem. I think the settings you want, as suggested by Paolo's reply, are the axis label properties, specifically

<option name="charting.axisLabelsX">time</option>
<option name="charting.axisLabelsX.majorUnit">P1D</option>

Unfortunately,

• majorUnit doesn't seem to work;
• setting the axis label type to "time" requires the Flash chart widget.

[hjwang]

Here, i have the same problem with it. when i timechart graph and use span=1d, the X-axis label does not display by day but by 7 day when searching one month data

[nvonkorff]

I see the same thing. I run a report spanning a 24 hour period, and I want the X axis labels on each hour, whereas they currently display at 12am, 4am, 8am, 12pm, 8pm.

I've tried playing around with span and bins timechart options, but no matter what I try, I can't get the X axis labels to display hourly, even though there us plenty space on the chart to display more labels.

It would also be useful to be able to display gridlines on the X Axis, i.e. a vertical line for each hour/time band going up the chart. Anyone know how to do that?

[Paolo_Prigione]

I think you then have to dig into the Custom Charting functionalities following the instructions provided here in the Developer manual. You should have to modify the X axis' label major/minor units.

Please post an example if you are able to accomplish the task as this is a topic with rare examples...

[srw46]

Thank you for your answers guys, this has proved useful but it is not exactly what I'm after.

I'm now familiar with changing the span and the intervals that the graph plots on but I'm interested in changing what is literally written underneath the X axis for visibility purposes.

Regardless of what I change the actual spanning on the chart too, what is displayed under the X axis is still in a four hour format - i.e. 12:00 - 16:00 - 20:00 - 00:00 - 04:00 - 08:00.

How can I manipulate these? Or should they be changing with the span and I'm a victim of some quirk?

[sideview]

Yes this is possible from the Report Builder interface.

1) When you have 'Values over time' selected in step 1 of Report Builder, look down a bit. You'll see a link that says

"Set span for time axis intervals (for example: every hour)"

Click this link and you'll see some form elements open up. It should be fairly self-explanatory from there, but you can tell timechart to use buckets of 5 seconds or 3 hours or whatever you want.

2) Alternately, you can set the Report Builder pulldowns the way you want, and then click the tiny link near the top "Define search using search language". This will take you out of what we call the 'basic' mode, so all the pulldowns will dissappear.

Instead you'll just have the big search box to type your report in manually. And from there you want to use the span or perhaps the bins arguments.

<your search> | timechart span=1h avg(foo)

And you can read up about span and bins here.

http://www.splunk.com/base/Documentation/latest/SearchReference/Timechart

[yaetis]

I have the same problem even after mentioning span=1d the visualization still doesn't display actual label on a 1 day interval.

[ziegfried]

You can do this by performing the aggregation in your search. Like

<your search> | timechart span=1h count

and then click on "show report" (Notice the link should change form "build report" to "show report".