Splunk Search

Formatting axis lables on a time based chart

tsmithsplunk
Path Finder

I have a search that uses timechart to show a count of certain events per day for a one month period. Nothing fancy:

index=x earliest=-30d@d ... | timechart span=1d count by threadpool

Works fine but of course it shows only about 5 X axis labels. I would prefer it show one for every day in the month. There is room for this but only if the date/time label can be reformatted. It currently shows as "Mon May 1 2017". That label is too long. So when I force a label per day using:

<option name="charting.axisLabelsX.majorUnit">P0Y0M1DT0H0M0S</option>

Now all the label text overlaps and it becomes unreadable. I can't find a way to reformat the date on a timechart (if this is possible let me know!), so how can I change my search to use "chart" and still get a data point per day per series?

Thanks!
Using v5.0.14 (I know, we're way behind. I wish I could rotate the labels but that isn't supported.)

0 Karma
1 Solution

cmerriman
Super Champion

try using chart instead of timechart, though if you're exporting a PDF, it might not export the labels. i'm adding the eval just to reformat the time if you need it, feel free to remove.

|chart span=1d count by threadpool|eval _time=strftime(_time,"%Y/%m/%d")

or

|bucket span=1d _time|eval _time=strftime(_time,"%Y/%m/%d")|stats count by _time threadpool

View solution in original post

0 Karma

cmerriman
Super Champion

try using chart instead of timechart, though if you're exporting a PDF, it might not export the labels. i'm adding the eval just to reformat the time if you need it, feel free to remove.

|chart span=1d count by threadpool|eval _time=strftime(_time,"%Y/%m/%d")

or

|bucket span=1d _time|eval _time=strftime(_time,"%Y/%m/%d")|stats count by _time threadpool
0 Karma

tsmithsplunk
Path Finder

Your second idea works great. Thanks.

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...