Splunk Search

How do I modify the label for x-axis?

reswob4
Builder

I have a lookup table similar to the following:

Week                   Status                     Number
13 May 17                Open                       5
13 May 17                Closed                     3
20 May 17                Open                       7
20 May 17                Closed                     4

I built a timechart using the following syntax:

| inputlookup lookup.csv | eval _time=strptime(Week, "%d %b %y") | timechart span=1w Values(Number) by Status 

That produces a line graph timechart, but the x-axis labels are changed:

Mon 8 May
Mon 15 May

What am I not understanding about the strptime command that it's changing the date?

And most importantly, how do I make the change the x-axis label to say something like "Week ending 13 May", "Week ending 20 May"

I looked at the timewrap command but

| inputlookup lookup.csv | eval _time=strptime(Week, "%d %b %y") | timewrap w | timechart span=1w Values(Number) by Status 

gives me a chart with four data points all on the left y-axis point "Mon May 22":

"Closed, 2 weeks before", "Open, 2 weeks before", "Closed, 1 week before", "Open, 1 week before".

I need two lines with two data points like I get with the first search.

Thanks.

0 Karma
1 Solution

kellewic
Path Finder

It's timechart that changes the dates to it's own format from the strptime format. As far as I know there's no way in search to customize that. You can go a different route and bin _time, use xyseries, and finally change the format after:

|inputlookup lookup.csv
|eval _time=strptime(Week, "%d %b %y")
|bin _time span=1w
|xyseries _time Status Number
|eval _time=strftime(_time, "Week ending %d %b")

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval raw="13 May 17,Open,5
13 May 17,Closed,3
20 May 17,Open,7
20 May 17,Closed,4" 
| makemv delim="
" raw 
| mvexpand raw 
| rename raw AS _raw 
| rex "^(?<Week>[^,]+),(?<Status>[^,]+),(?<Number>.*)$" 
| table Week Status Number

| rename COMMENT AS "Everything above creates test events; everything below is your solution"

| chart sum(Number) OVER Week BY Status
| eval _time=strptime(Week, "%d %b %y") 
| sort 0 _time
| fields - _time
0 Karma

kellewic
Path Finder

It's timechart that changes the dates to it's own format from the strptime format. As far as I know there's no way in search to customize that. You can go a different route and bin _time, use xyseries, and finally change the format after:

|inputlookup lookup.csv
|eval _time=strptime(Week, "%d %b %y")
|bin _time span=1w
|xyseries _time Status Number
|eval _time=strftime(_time, "Week ending %d %b")
0 Karma

reswob4
Builder

Thanks. That worked great.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...