How to modify the timechart x-axis label

[hjwang]

Dear all

I found that if I use "mysearch | timchart span=1d count by host(timerange is one month)", the x-axis representing time interval will not display all time label (here, one day) but only show every 7 day interval, for example, Friday July 1 2011, Friday July 8 2011, Friday July 15 2011...etc. How to tell splunk to show all span datetime like Friday July 1 2011, Saturday July 2 2011, Sunday July 3 2011..etc. As searching for similar question, it seems others have the same thing.

Thanks in advance

[RicoSuave]

Try using the eval command with the strftime argument. Try this search

mysearch | eval Time = strftime(_time, "%H:%M") | chart span=1d host over Time