Splunk Search

Chart to show only values in X axis label when span=1m and query running for 1 day.

Path Finder

Hi All,  

I have a requirement where I need to show only alternate X axis label when I am running a chart command: 

index=xyz  | bin _time span=1m| eval time1 = strftime(_time, "%d %b %H:%M")|chart count by time1. 

As th query is ran for entire day and span mentioned is 1 minute,  the x-axis label is not being displayed .  Is there any way we can just show only 4 to 5 dates in the x axis label? 




Labels (1)
Tags (3)
0 Karma


@arjit  what youre asking is not really a splunk item but rather a math question.

time is a unit of measure. I can't imagine any scenario where what you're asking would be advisable. If you need to show more than one measure of time on the x axis, then my suggestion would be to interpret the question differently.

x would be remain same unit of time

y would display your 4 dimensions measured the same based on the same set of time.

for example if you need to dipslay 4 activities for a specified time, then measure your 4 activities and how well it didi within the specified time.

I hope that makes sense


0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!