Splunk Search

Center _time on a column chart



I would like to center the dates of my timechart (column) :






I'm using the timechart command in order to get a table that is then transformed in a column chart.

How can I do this?

Thank you.

Best regards,

Labels (3)
0 Karma


The times created by timechart represent the start of the period / span so aligning to the axis marker makes sense i.e. the anchor for the label is to the left and the data at this point in the chart is no earlier than the value of the label. There is no anchor point in the middle of the bar in the barchart with which to align the text even if you wanted to. You might be able to hack around this by formatting the time (strftime) with leading spaces, however, you may find that the chart viz will strip leading/trailing spaces before displaying the x-axis label anyway.

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...