Splunk Search

Timechart - xaxis - label customization

Path Finder

Is it possible to customize the x-axis labels that displays 0, 10, 20, ... 60
(where each number represents number of seconds)

For example, my search results are from say 15:28:00 -to- 15:30:00 (for 3 mins)
Instead of x-axis saying "3:28PM Wed Mar 25 2015", can we make it say 0, 1, 2, 3 (in mins)?

Is this possible?

Tags (3)
0 Karma


Here is an example where i count sourcetypes by Minutes in the _internal index. Take a look at it: index=_internal sourcetype=*| eval minutes=strftime(_time, "%M")|chart count by minutes |head 20

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!