Splunk Search

How can I make only date appear in the X-label of xyseries plot?

smhsplunk
Communicator

I only have year-month-day in my _time, when I use table to show in search, it only gives me dates. Yet when I use xyseries, it gives me date with HH:MM:SS. How can I make only date appear in the X-label of xyseries plot?

| xyseries _time,series,yval
0 Karma

sundareshr
Legend

Try this

... | eval time=strftime(_time, "%Y-%m-%d") | xyseries time series yval
0 Karma

smhsplunk
Communicator

I already have that, it still giving me long digits after the date. here is the code

<row>
<panel>
      <chart>
        <search>
          <query>index=xyz sourcetype=xyz1 source=xyz3 id!="nan" 
                        | search * id = "$new_hosts$"
                        | eval mytime=strptime(initial_date, "%Y-%m-%d") 
                        | eval _time=mytime
                        | xyseries _time,id,error_values</query>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">-90</option>
        <option name="charting.chart">line</option>
        <option name="charting.seriesColors">[0x639BF1, 0xFF5A09]</option>
        <option name="height">200</option>
      </chart>
    </panel>
  </row>
0 Karma

smhsplunk
Communicator

I am actually getting this
2016-08-10T00:00:00.000-04:00

where I should only be getting this
2016-08-10

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...