Splunk Search

Timechart x-axis customized time

New Member

I am getting date from my device in search date field like date=20140408045219. So i wanted to show the time chart according to date field in x-axis not _time. Any suggestion will be helpful?

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

You might be able to do something like this:

base search | eval _time = strptime(date, "%Y%m%d%H%M%S") | timechart ...

However, do consider if it makes sense to use that date field as the actual _time value when indexing future data.

View solution in original post

0 Karma

Explorer

You may want to try the chart command. "Unlike the timechart command which generates a chart with the _time field as the x-axis, the chart command produces a table with an arbitrary field as the x-axis."

0 Karma

New Member

Thanks for your suggestion martin. But it still taking _time on x-axis its not taking my time which is coming through eval _time = strptime(date, "%Y%m%d%H%M%S").

0 Karma

SplunkTrust
SplunkTrust

You might be able to do something like this:

base search | eval _time = strptime(date, "%Y%m%d%H%M%S") | timechart ...

However, do consider if it makes sense to use that date field as the actual _time value when indexing future data.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

When I run this over here:

index=_internal | head 1 | eval date="20140408045219" | eval _time = strptime(date, "%Y%m%d%H%M%S") | timechart count

I get a blip at 4:52AM rather than now (3:50PM).

It's still using the field called _time, but with the value you've changed it to.

0 Karma