Iam getting different results for same query when checked in statistics and visualizations, Attaching both screenshots
The data in the chart is consistent with the data in the table - the issue is that the chart is treating _time as a special case of field - you can get around this by creating a new field called time and removing _time - you would need to ensure that the time field is listed first so that it becomes the x-axis
| gentimes start=-365
| rename starttime as _time
| fields _time
| eval location=mvindex(split("ABCDEFGH",""),random()%8)
``` the lines above generate random data for testing ```
| timechart span=1mon count by location
| tail 6
| eval time=strftime(_time,"%Y-%m")
| fields - _time
| table time *
The data in the chart is consistent with the data in the table - the issue is that the chart is treating _time as a special case of field - you can get around this by creating a new field called time and removing _time - you would need to ensure that the time field is listed first so that it becomes the x-axis
| gentimes start=-365
| rename starttime as _time
| fields _time
| eval location=mvindex(split("ABCDEFGH",""),random()%8)
``` the lines above generate random data for testing ```
| timechart span=1mon count by location
| tail 6
| eval time=strftime(_time,"%Y-%m")
| fields - _time
| table time *
Thank you! It is working
What do you mean by "different results"? They seem pretty much consistent.
in table , _time is converted into month buckets but in chart, in X-axis its not getting showing monthly buckets
That's simply how Splunk shows the _time field. The data is consistent, the presentation might indeed be a bit confusing. You can get around it as @ITWhisperer showed already.