Splunk Search

How to change the _time to X-axis in a time chart table?

Explorer

Currently I am using the search below to generate an error codes report in my application.

source="log_file_name.log" | rex "(?<errorCode>OPT-\w{6})" | timechart span=1d count by errorCode usenull=f useother=f | rename _time as Time | eval Time=strftime(Time, "%d-%b-%Y") | sort date_numericmonth desc

It's showing the results as below.
Error codes table

When there are more error codes, then it's currently required to scroll the horizontal line bar. Instead, is there any possibility to switch Time to the X-Axis and Error Codes on Y-Axis in the table?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try this

source="log_file_name.log" | rex "(?<errorCode>OPT-w{6})" | chart count over errorCode by tiime usenull=f useother=f | rename _time as Time | eval Time=strftime(Time, "%d-%b-%Y") | sort date_numericmonth desc

Adjust the search according to your requirement . For reference : http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/chart

View solution in original post

SplunkTrust
SplunkTrust

Try this

source="log_file_name.log" | rex "(?<errorCode>OPT-w{6})" | chart count over errorCode by tiime usenull=f useother=f | rename _time as Time | eval Time=strftime(Time, "%d-%b-%Y") | sort date_numericmonth desc

Adjust the search according to your requirement . For reference : http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/chart

View solution in original post