Splunk Search

How do you get events time interval as 15 minutes on timechart x-axis?

prathapkcsc
Explorer

Hi one and all,
I have my log data as below for every 15min interval.

2018-08-23,16:16,11230,37393,49019
2018-08-23,16:16,11631,37943,49973
2018-08-23,16:47,17014,55890,73450

This is how i have data for 24 hrs. When i do 'timechart` the graph bins automatically showing with 4 hrs gap on scale. But i wanted 15m wise points on graph along with the time on x-axis.
please see the below picture for expected output
alt text

what i am getting is below from timechart command
alt text

I want 15m scale on x-axis.can some one help on this?
Thanks in advance.

0 Karma

nadlurinadluri
Communicator

Can you show the "statistics tab" with _time and values that would be helpful

0 Karma

horsefez
Motivator

Hi @prathapkcsc,

this might help you.

https://answers.splunk.com/answers/91717/timechart-x-axis.html

so for your search that should look like this

...| timechart span=15m fixedrange=true ...

you need to edit the SimpleXML options of the chart on the dashboard, adding the following:

<option name="charting.scaleX">1</option>
<option name="charting.axisLabelsX.majorUnit">P0Y0M0DT0H15M0S</option>
0 Karma

prathapkcsc
Explorer

I tried this. It didn't work with my dash board.

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...