Splunk Search

Why does placing "table _time" after timechart make x-axis labels disappear on JSChart?

Communicator

I have a simple search like:

sourcetype="A" | timechart span="1h" avg(x) as AvgCode

and the resulting visualization is:
alt text

But if insert a table command after `timechart' (which shouldn't change anything),

sourcetype="A" | timechart span="1h" avg(x) as AvgCode | table _time, AvgCode

labels on the x-axis disappear:
alt text

Why does it happen?
The results are absolutely the same and I'm keeping the _time field in the resulting data.

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Hi @greg,
I think the problem might be using "timechart" with "table". The "table" command documentation includes this note:

"The table command can be used to build a scatter plot to show trends in the relationships between discrete values of your data. Otherwise, you should not use it for charts (such as chart or timechart) because the UI requires the internal fields (which are the fields beginning with an underscore, _*) to render the charts, and the table command strips these fields out of the results by default. Instead, you should use the fields command because it always retains all the internal fields."
http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Table

Here is documentation for the "fields" command:
http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Fields

Can you try using "fields" instead? Let me know if this does not help.

Best,
@frobinson_splunk

View solution in original post

Splunk Employee
Splunk Employee

Hi @greg,
I think the problem might be using "timechart" with "table". The "table" command documentation includes this note:

"The table command can be used to build a scatter plot to show trends in the relationships between discrete values of your data. Otherwise, you should not use it for charts (such as chart or timechart) because the UI requires the internal fields (which are the fields beginning with an underscore, _*) to render the charts, and the table command strips these fields out of the results by default. Instead, you should use the fields command because it always retains all the internal fields."
http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Table

Here is documentation for the "fields" command:
http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Fields

Can you try using "fields" instead? Let me know if this does not help.

Best,
@frobinson_splunk

View solution in original post

Communicator

Yes, specifying 'fields _time, AvgCode' or 'table _*, AvgCode' returned x-axis labels back.
Thank you for pointing this out!

Splunk Employee
Splunk Employee

Ah, great. Glad that this worked!
@frobinson_splunk

0 Karma