Splunk Search

How do you get events time interval as 15 minutes on timechart x-axis?

prathapkcsc
Explorer

Hi one and all,
I have my log data as below for every 15min interval.

2018-08-23,16:16,11230,37393,49019
2018-08-23,16:16,11631,37943,49973
2018-08-23,16:47,17014,55890,73450

This is how i have data for 24 hrs. When i do 'timechart` the graph bins automatically showing with 4 hrs gap on scale. But i wanted 15m wise points on graph along with the time on x-axis.
please see the below picture for expected output
alt text

what i am getting is below from timechart command
alt text

I want 15m scale on x-axis.can some one help on this?
Thanks in advance.

0 Karma

nadlurinadluri
Communicator

Can you show the "statistics tab" with _time and values that would be helpful

0 Karma

horsefez
Motivator

Hi @prathapkcsc,

this might help you.

https://answers.splunk.com/answers/91717/timechart-x-axis.html

so for your search that should look like this

...| timechart span=15m fixedrange=true ...

you need to edit the SimpleXML options of the chart on the dashboard, adding the following:

<option name="charting.scaleX">1</option>
<option name="charting.axisLabelsX.majorUnit">P0Y0M0DT0H15M0S</option>
0 Karma

prathapkcsc
Explorer

I tried this. It didn't work with my dash board.

0 Karma
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...