Splunk Search

Center _time on a column chart

incognito
Explorer

Hello,

I would like to center the dates of my timechart (column) :

center.PNG

 

 

 

 

I'm using the timechart command in order to get a table that is then transformed in a column chart.

How can I do this?

Thank you.

Best regards,

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The times created by timechart represent the start of the period / span so aligning to the axis marker makes sense i.e. the anchor for the label is to the left and the data at this point in the chart is no earlier than the value of the label. There is no anchor point in the middle of the bar in the barchart with which to align the text even if you wanted to. You might be able to hack around this by formatting the time (strftime) with leading spaces, however, you may find that the chart viz will strip leading/trailing spaces before displaying the x-axis label anyway.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...