Splunk Dev

How to display all months (irrespective of data present for that particular month) on the X-axis when using timechart.

ManoDavidson
New Member

Hi,
I'am relatively new to splunk and exploring Timechart.
I want to display a stacked bar chart which will have count of "state" (for eg: closed, completed,etc) stacked on x-axis on over another.
The x-axis will have all the all the months, irrespective of data present for that month as shown in below image.
[ query:

| eval _time = strptime(opened_at,"%d/%m/%Y")
| timechart count(state) as Value by state
| eval Time=strftime(_time, "%b %Y")
]

alt text

But i want to display all the months here and hence i used below query to display all the months, but im unable to reproduce the stacked bars for unknown reasons.
[query:
| eval _time = strptime(opened_at,"%d/%m/%Y")
| timechart count(state) as Value by state
| eval Time=strftime(_time, "%b %Y")
| table Time,Value
]

alt text
kindly help

Tags (1)
0 Karma

xpac
SplunkTrust
SplunkTrust

Hey, try using | timechart span=1mon - then timechart will not automatically determine which time slots to group, but will build one per month.

ManoDavidson
New Member

Hi xpac,
I tried the same, but I am still getting an empty timechart like the second image i shared.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...