Splunk Search

Modifying x-axis format

user789
New Member

I am trying to re-format the x-axis time to read cleaner. Here is my spl:
index="servers" source="/var/log/secure" action=failure
| timechart count
| eval time=_time
|table time count
| fieldformat time=strftime(time, "%Y%m%d%H%M")

How can I get it in a format like %Y-%m-%d %H:%M ?

Labels (4)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

fieldformat should be all you need.

index="servers" source="/var/log/secure" action=failure
| timechart count
| fieldformat _time=strftime(_time, "%Y-%m-%d %H:%M")
---
If this reply helps you, an upvote would be appreciated.
0 Karma

user789
New Member

When I try this, I don't get any results.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It works for me, but the format of _time changes only in the timechart output - not in the visualization. The viz appears to be fixed.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

user789
New Member

With this I get a visualization with count on the bottom, then above that, another x-axis labeled" _span".

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I don't know where "_span" is coming from. On my system it's "_time".
You can turn off the x-axis label, by the way. Click the format icon on the viz and there will be options to control the x-axis, y-axis, legend, and other settings.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.