Splunk Dev

How to display all months (irrespective of data present for that particular month) on the X-axis when using timechart.

ManoDavidson
New Member

Hi,
I'am relatively new to splunk and exploring Timechart.
I want to display a stacked bar chart which will have count of "state" (for eg: closed, completed,etc) stacked on x-axis on over another.
The x-axis will have all the all the months, irrespective of data present for that month as shown in below image.
[ query:

| eval _time = strptime(opened_at,"%d/%m/%Y")
| timechart count(state) as Value by state
| eval Time=strftime(_time, "%b %Y")
]

alt text

But i want to display all the months here and hence i used below query to display all the months, but im unable to reproduce the stacked bars for unknown reasons.
[query:
| eval _time = strptime(opened_at,"%d/%m/%Y")
| timechart count(state) as Value by state
| eval Time=strftime(_time, "%b %Y")
| table Time,Value
]

alt text
kindly help

Tags (1)
0 Karma

xpac
SplunkTrust
SplunkTrust

Hey, try using | timechart span=1mon - then timechart will not automatically determine which time slots to group, but will build one per month.

ManoDavidson
New Member

Hi xpac,
I tried the same, but I am still getting an empty timechart like the second image i shared.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...