Splunk Search

Dates cluttered in X-axis

freephoneid
Path Finder

Hi,

I've column chart which uses below query:

index=test | stats last(_time) AS time by customerid | convert timeformat="%Y-%m-%d" ctime(time) AS datetime | stats count(customerid) by datetime

The above chart works fine & displays dates on X-axis. I've also added timerangepicker drop-down so that it displays the results based on the date range selected in drop-down. However, if I select "Last 30 Days", then the dates on X-axis become all cluttered & does not look good.

Is there any way I can show only certain dates whenever I select large time range (just like timechart)??

If this is not possible, how can I convert above query to use the timechart so that it won't clutter the dates?

Thanks!

Tags (2)

woodcock
Esteemed Legend

You are correct, the only good way to get flexible ("nice") automatically adjusting X-axis labels for times is to use timechart. Try something like this:

 index=test | timechart span=1h dc(customerid)

Or maybe this:

 index=test | timechart span=1h count

BTW, when I do things like this, I create a simple XML form with 2 controls: Chart Timespan/Width (which is the timepicker repackaged) and Interval-Span/Bucket-Size which is the span=1h part with hard-coded options like this:
5 minutes
15 minutes
30 minutes
1 hour
2 hours
6 hours
1 day

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How much can you really learn in 3 minutes?

Observability can certainly be hard to understand – there's a lot of jargon and buzzwords and it seems to ...

Event Series: The Agentic SOC: Trust Before Autonomy

AI is fundamentally changing security operations, but true progress requires more than just automation—it ...

Free Professional Services for .conf26 Attendees

This year at .conf26, we are doing something a little different. We are bringing the best minds from ...