Splunk Search

Center _time on a column chart



I would like to center the dates of my timechart (column) :






I'm using the timechart command in order to get a table that is then transformed in a column chart.

How can I do this?

Thank you.

Best regards,

Labels (3)
0 Karma


The times created by timechart represent the start of the period / span so aligning to the axis marker makes sense i.e. the anchor for the label is to the left and the data at this point in the chart is no earlier than the value of the label. There is no anchor point in the middle of the bar in the barchart with which to align the text even if you wanted to. You might be able to hack around this by formatting the time (strftime) with leading spaces, however, you may find that the chart viz will strip leading/trailing spaces before displaying the x-axis label anyway.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...