Splunk Search

change the time format in timechart tooltip

vaishnavi07
Explorer

How to change the time format in timechart tooltip? its in AM/PM format but i need to change to 24hr format.

Tags (1)
0 Karma

architkhanna
Path Finder

Do we have an answer for this yet?I am still struggling.It would be great if someone could help.

0 Karma

linu1988
Champion

Hello Vaishnavi,
You have one single solution left. Use stats instead of timechart

search...|eval Time=strftime(_time,"%d-%m-%Y %T")|stats count by Time

Hoping this is what you are looking for.

Thanks

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

That happens because you lose the bucketing and the smart x-axis-labeling performed by the timechart.

The labeling is not nice to look at, but the lack of bucketing severely changes the result of your query. You can do this:

... | bucket _time | eval time = strftime(...) | chart count by time

You will still get the less-than-smart x-axis labeling. That relies on having epoch timestamps, and will automatically fall back to formatting them according to your locale.

vaishnavi07
Explorer

Thanks. Time format is changing but the dates on the x-axis look like this --> |...|...|

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

That timestamp is formatted according to your browser's locale, as seen at the front of the Splunk URL. For example, en-US will render an AM/PM time while en-GB will render a 24h time.

vaishnavi07
Explorer

I am still searching for a solution. Please help.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I don't know of any.

0 Karma

vaishnavi07
Explorer

is there any way to change time format in tooltip alone?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Renaming the _time field will indeed break the axis labels, those rely on that field and the _span field.

0 Karma

vaishnavi07
Explorer

Yeah but is it possible to change the time format? i tried changing the format of time as follows,
Mysearch | timechart avg(*) | rename _time as Time | convert timeformat="%H:%M" ctime(Time) AS Time
Time format is getting changed in tooltip but x-axis labels are not getting displayed.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...