your line chart looks like it is not coming from the
Do you use the
_time field? Or just
time with values of the format
I tried to copy your effect and avoid using
timechart on some internal data (last 24h):
index = _internal sourcetype=splunkd component=*process* | stats count by component _time | eval _time=strftime(_time,"%FT%T%z") | xyseries _time component count
Even then the splunk search visulization formats my x axis of the line chart with "good" time labels.
But if I use this instead:
index = _internal sourcetype=splunkd component=*process* | stats count by component _time | eval time=strftime(_time,"%FT%T%z") | xyseries time component count
The labels of the x axis look like in your chart.
Does this help?
eventtype=SummaryTiming | eval server=substr(source, 11, 6) | search FunctionAction=ll.browse AND server=wfe* AND date_hour>=6 AND date_hour<18 | timechart cont=FALSE span=3h eval(round(avg(ExecutionTime),2)) as AvgExec by server
Thanks for the help, I've posted my query above and I'm using the timechart in it. I ran your query and got the same display results initially but as it got more stats, splunk formatted the x-axis. To be clear, I want to get the formatting shown in the first image.