change the time format in timechart tooltip

[vaishnavi07]

How to change the time format in timechart tooltip? its in AM/PM format but i need to change to 24hr format.

[architkhanna]

Do we have an answer for this yet?I am still struggling.It would be great if someone could help.

[linu1988]

Hello Vaishnavi,
You have one single solution left. Use stats instead of timechart

search...|eval Time=strftime(_time,"%d-%m-%Y %T")|stats count by Time

Hoping this is what you are looking for.

Thanks

[martin_mueller]

That happens because you lose the bucketing and the smart x-axis-labeling performed by the timechart.

The labeling is not nice to look at, but the lack of bucketing severely changes the result of your query. You can do this:

... | bucket _time | eval time = strftime(...) | chart count by time

You will still get the less-than-smart x-axis labeling. That relies on having epoch timestamps, and will automatically fall back to formatting them according to your locale.

[vaishnavi07]

Thanks. Time format is changing but the dates on the x-axis look like this --> |...|...|

[martin_mueller]

That timestamp is formatted according to your browser's locale, as seen at the front of the Splunk URL. For example, en-US will render an AM/PM time while en-GB will render a 24h time.

[vaishnavi07]

I am still searching for a solution. Please help.

[martin_mueller]

I don't know of any.

[vaishnavi07]

is there any way to change time format in tooltip alone?

[martin_mueller]

Renaming the _time field will indeed break the axis labels, those rely on that field and the _span field.

[vaishnavi07]

Yeah but is it possible to change the time format? i tried changing the format of time as follows,
Mysearch | timechart avg(*) | rename _time as Time | convert timeformat="%H:%M" ctime(Time) AS Time
Time format is getting changed in tooltip but x-axis labels are not getting displayed.