Change the time format in time chart tool tip

[rajeshjlnt]

We have time-chart visualization on a dashboard. The events are uploaded manually on last day of every month with timestamp of last day of month.

Tool tip, when hovered over the line chart visualization shows date as first day of the month with format MMM D, YYYY
I would like to format the date to show either date that the source has been indexed with or show only Month and Year.

Please provide me your suggestions on how this can be achieved.

[DalJeanis]

Your question seems to have to do with more the event format than the tooltip. Two different possibilities, depending on what you are asking for.

Since your data is a monthly basis, add span=1mon to your timechart command and see if that gets you what you want.

If not, then start by looking at one event

 (your search) 
| head 1
| eval MyTime= strftime(_time,"%Y-%m-%d %H:%M:%S.%3N")
| eval MyIndexTime= strftime(_indextime,"%Y-%m-%d %H:%M:%S.%3N")

See what the index time for the event is, and what the _time is. Reply and we'll see what we can do.

[rajeshjlnt]

1. I am currently using "timechart span=1mon". This shows 1st day of month in Tool tip.
2. I am getting following for your search, MyTime: 2020-03-31 23:30:00.000 MyIndexTime = 2020-04-01 12:45:10.000

To give more info on how i upload data,
- I get a monthly report (xls) on first day of next month. March report is generated on 1st of April.
- Using "TIMESTAMP_FIELDS" in sourcetype, i have configured a column name 'timestamp' from which splunk needs to fetch timestamp during indexing. This is what we see in 'MyTime'
- In the xls i want to index, i add a column 'timestamp' and fill in last day of month and upload this file to splunk. 'MyIndexTime' is showing date on which i have uploaded the data.