Splunk Search

How to make X axis show dates not just date field

kirrusk
Communicator

Hi 

 

I'm trying to add a chart by using the below query, in chart lines Date is coming.
But in x-axis shows only the Date field instead of Dates.

 

 

 

index=_internal FIELD1=* FIELD2=*  | eval Date=(_time, "%d/%m/%y")
| sort Date
| eval Date=(_time, "%d/%m/%y")
| table Date FIELD1 FIELD2 

 

 

 

Labels (5)
Tags (1)
0 Karma

kirrusk
Communicator

working if browser window minimized or may be by using rotating, but my requirement change to display weekly data. So the date is populating properly.

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What are you attempting to do?

Converting _time to a string (Date) and then sorting will sort lexicographically and given that you put day first you will get 11/2 ahead of 2/2 - is that what you intended?

The _time field is usually displayed in local format in charts etc. so perhaps you would be better off using

| table _time Field1 Field2

 

0 Karma

kirrusk
Communicator

@ITWhisperer 

I appended some data to existing data in the index, which is coming from CSV, in that date format will be like 01/12/22
so I convert _time to  %d/%m/%y

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try converting it the other way using strptime?

0 Karma

kirrusk
Communicator

@ITWhisperer just found, using %d/%m/%y the format I can see the date in the x-axis, but only when a short time range selecting.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You might also want to consider rotating the label used on the x-axis so more values can be squeezed in

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...