Splunk Search

How to change the _time to X-axis in a time chart table?

parameshjava
Explorer

Currently I am using the search below to generate an error codes report in my application.

source="log_file_name.log" | rex "(?<errorCode>OPT-\w{6})" | timechart span=1d count by errorCode usenull=f useother=f | rename _time as Time | eval Time=strftime(Time, "%d-%b-%Y") | sort date_numericmonth desc

It's showing the results as below.
Error codes table

When there are more error codes, then it's currently required to scroll the horizontal line bar. Instead, is there any possibility to switch Time to the X-Axis and Error Codes on Y-Axis in the table?

0 Karma
1 Solution

renjith_nair
Legend

Try this

source="log_file_name.log" | rex "(?<errorCode>OPT-w{6})" | chart count over errorCode by tiime usenull=f useother=f | rename _time as Time | eval Time=strftime(Time, "%d-%b-%Y") | sort date_numericmonth desc

Adjust the search according to your requirement . For reference : http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/chart

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

Try this

source="log_file_name.log" | rex "(?<errorCode>OPT-w{6})" | chart count over errorCode by tiime usenull=f useother=f | rename _time as Time | eval Time=strftime(Time, "%d-%b-%Y") | sort date_numericmonth desc

Adjust the search according to your requirement . For reference : http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/chart

---
What goes around comes around. If it helps, hit it with Karma 🙂
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...