When doing a query like so
* | timechart span=1d count
I would expect the intervals on the x-axis to be 1 day per tick, but instead it is 2 days per tick.
Is there a way to format the x-axis to follow the span?
Maybe specifying something "manually" to alter the x-axis would also be fine.
Thanks in advance
If you select to view the data as a table instead of a chart (using the buttons just above and to the left of the chart), do the columns in the table represent 1 day or 2 day periods? If 1 day then the data is correct but something is skewing your chart view, such as screen resolution / browser window size...
The time span in this case is 7 days, which gives me the ticks that are 2 days apart. In another case I need the chart to cover a month in which case the ticks are 7 days apart, which doesn't work out for me either.
Sadly I can't change the time span of the searches to be less.
If only it was possible to specify "Major unit" for x-axis in the dashboard as it is possible for the y-axis.
I'm afraid I need every day to appear on the chart regardless of the results on the given day. Thanks though
What is the time span for your search? If it is too large to display the data at 1 day per column (for example) then it will combine the columns to cover multiple days. A smaller time span will likely change the chart to display the data as you like. (Of course, you might already know this or are having other issues.)
The other thing you can do is to filter the results to show only the results where the value is above a certain threshold to reduce the amount of noise in the chart.