Why does using "xyseries" command return extra digits attached with the _time label?

[smhsplunk]

I am trying to get a nice Y-m-d on my x axis label using xyseries
but am getting a long value attached with the date

i.e. 2016-07-05T00:00:00.000-04:000

How can I get only the first part in the x-label axis "2016-07-05"

index=street_info  source=street_address
                        | eval mytime=strptime(record_date, "%Y-%m-%d") 
                        | eval _time=mytime 
                        | xyseries _time, street_id, myvalue

even when I use table _time, street_id, value it only shows Y-m-d.
I am not doing sum here, just showing the exact values on the Y-axis against time on X-axis.

please help

THanks

[somesoni2]

You can use fieldformat command to format the way _time values are shown in chart (without modifying the underlying epoch value)

index=street_info  source=street_address
| eval _time=strptime(record_date, "%Y-%m-%d") 
| xyseries _time, street_id, myvalue 
| fieldformat _time=strftime(_time, "%Y-%m-%d") 

[cmerriman]

try something like:

index=street_info  source=street_address
                         | eval mytime=strftime(strptime(record_date, "%Y-%m-%dT%H:%M:%S.%3Q%:z"),"%Y-%m-%d")
                         | eval _time=mytime 
                         | xyseries _time, street_id, myvalue

here are docs on time formats and functions:

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables
https://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/CommonEvalFunctions#Date_and_Time...

[hunters_splunk · Accepted solution]

Hi smhsplunk,

You can use appropriate data time format variables to format _time, for example:

strftime(_time, "%b %d, %I")

For detailed information, please refer to documentation:
http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Commontimeformatvariables

Hope this helps. Thanks!
Hunter

[smhsplunk]

This worked | eval _time = strftime(_time, "%Y %b %d")