How do I calculate and present values on a day-by-day basis in a bar chart?

[lctanlc]

This is how my log file looks like:
2017-06-02 17:07 - SearchTime: 16414
2017-06-02 18:05 - SearchTime: 6450
2017-06-02 18:05 - SearchTime: 2555
2017-06-02 23:51 - SearchTime: 2066
2017-06-03 04:28 - SearchTime: 982
2017-06-05 07:15 - SearchTime: 9568
2017-06-05 09:15 - SearchTime: 7344
2017-06-05 09:25 - SearchTime: 34150
2017-06-06 14:15 - SearchTime: 18875

I could do the following query to calculate the "TotalSearches" and "10sPercentrank" values for the past 5 days and its value is 66.67:
... |eval isOK=if(SearchTime<10000, 1, 0) | stats count as TotalSearches sum(isOK) as isOkTotal | eval 10sPercentrank=(isOkTotal/TotalSearches)*100 | table TotalSearches 10sPercentrank

However, I am now being asked to present the "TotalSearches" and "10sPercentrank" values by day in a chart. E.g.,
On 2017-06-02, the "TotalSearches" and "10sPercentrank" values are 75
On 2017-06-03, the "TotalSearches" and "10sPercentrank" values are 100
On 2017-06-04, the "TotalSearches" and "10sPercentrank" values are 0
On 2017-06-05, the "TotalSearches" and "10sPercentrank" values are 66.67
On 2017-06-06, the "TotalSearches" and "10sPercentrank" values are 0

How should I modify my query to achieve that?

[martin_mueller · Accepted solution]

Replace stats with timechart span=1d to get per-day statistics, and then set the visualization to column chart.

[martin_mueller]

Remove the table command, that implicitly drops all time information from your results. If you want to hide a field from the chart, use fields - fieldname

[lctanlc]

I am running on Splunk 6.4.3.
Everytime I fine-tuned and saved the Splunk dashboard, the spaces in the "fields - fieldname" portion of the query will be removed. Is there a way to prevent such removal?

[martin_mueller]

That's a bug in the xml formatter, 6.6.x should not do that any more.

[lctanlc]

It met my needs! Thanks a lot!

[lctanlc]

I have changed my query to be as follows:
|eval isOK=if(SearchTime<10000, 1, 0) | timechart spen=1d count as TotalSearches sum(isOK) as isOkTotal | eval 10sPercentrank=(isOkTotal/TotalSearches)*100 | table TotalSearches 10sPercentrank
May I know how to make my x-axis to show the date instead of the TotalSearches value?