Splunk Search

How to include x axis info on chart

kbcuait
Explorer

Hi, I have created a results chart using this search:

| dbquery "DBNAME" "SELECT useraction FROM usertable" | eval useraction=strftime(useraction,"%Y-%d-%m") | stats count by useraction

However there are no dates along the x axis, only the title of "useraction"

How can I get those there for context?

Thanks 🙂

Tags (3)
0 Karma

lguinn2
Legend

I am not sure that this will work, but try

| dbquery "DBNAME" "SELECT useraction FROM usertable" 
| eval useraction=strftime(useraction,"%Y-%d-%m")
| eval _time=strptime(useraction,"%Y-%d-%m")
| timechart span=5m count

Hopefully, this will build a timechart with 5 minute increments. You can set the span to something else if you want, but there is a limit to the number of datapoints that can be displayed in a chart. I forget what the limit it, but you should get an error message (red bar) if you try to exceed it.

0 Karma

kbcuait
Explorer

Hi and thanks - this gives me No results found

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...