Splunk Search

Timechart - xaxis - label customization

Path Finder

Is it possible to customize the x-axis labels that displays 0, 10, 20, ... 60
(where each number represents number of seconds)

For example, my search results are from say 15:28:00 -to- 15:30:00 (for 3 mins)
Instead of x-axis saying "3:28PM Wed Mar 25 2015", can we make it say 0, 1, 2, 3 (in mins)?

Is this possible?

Tags (3)
0 Karma


Here is an example where i count sourcetypes by Minutes in the _internal index. Take a look at it: index=_internal sourcetype=*| eval minutes=strftime(_time, "%M")|chart count by minutes |head 20

0 Karma