Can I format the y-axis on a chart to properly display military time?

[szimmer661]

I'm using the following to chart job end times over date:

index = ironstream MSGNUM = "IEF404I" ( JOBNAME = TZRPD85 OR TZRPDV9 OR TZRPD35 ) | eval JobEndDate=strftime(_time,"%m/%d/%Y") | eval JobEndTime=strftime(_time,"%H%M") | lookup MF_Jobname_Info.csv JOBNAME OUTPUT Job_Desc | eval JobNameDesc=JOBNAME+" "+Job_Desc | chart earliest(JobEndTime) over JobEndDate by JobNameDesc

The chart is working, except the JobEndTime, meant to be military time, is displaying on the y-axis as comma delimited whole numbers without leading zeroes.

Can I format the y-axis to properly display military time?

Thanks, Steve

[sundareshr]

Sounds like you need the timeline app

https://splunkbase.splunk.com/app/3120/

[szimmer661]

Thank you for the prompt reply. I will investigate the timeline app.

[somesoni2 · Accepted solution]

The y-axis values have to be numeric and the military time formatting will make it string. I don't think there is a workaround to this.

[szimmer661]

Thank you for the prompt reply. When I tried leaving the time alone, hh.mm, the chart would not display anything at all. Any suggestions would be greatly appreciated.

[somesoni2]

So, you're saying this query is showing blank result in chart (visualization)

 index = ironstream MSGNUM = "IEF404I" ( JOBNAME = TZRPD85 OR TZRPDV9 OR TZRPD35 ) | eval JobEndDate=strftime(_time,"%m/%d/%Y") | eval JobEndTime=strftime(_time,"%H.%M") | lookup MF_Jobname_Info.csv JOBNAME OUTPUT Job_Desc | eval JobNameDesc=JOBNAME+" "+Job_Desc | chart earliest(JobEndTime) over JobEndDate by JobNameDesc

Check the table/statistics for this query, it should give column values as decimal numbers

[szimmer661]

I was wrong above and must have parsed _time with %H:%M. Using %H.%M does show values in both the chart and the table. The y-axis is now showing whole numbers, up to 24 that I'll need to explain are the hours of the day and any hour before noon will not show a leading zero. It'll take some getting used to, but definitely workable.

Thanks for the help.