creating a scatterplot with time on the x-axis

[pbrunel_splunk]

I'm looking to create a multi-series scatter plot where time is on the x-axis.

An example would be something like this:

Attempts to do this in splunk are failing. Given the format requirements: ... | table marker_name_field x-axis_field y-axis_field

In the first attempt, using _time, all points are assigned an x-value of 0, like splunk can't understand the timestamp in its native/textual format. (see example below)

Using the timestamp in epoch format works in that it will correctly display points along the x-axis, but having a timestamp in that format is not human interpretable, so is not particular useful or viable as an option. (see example below)

Short of using D3 to create a custom viz, is there something I'm missing, or are Splunk's native viz capabilities unable to create this kind of chart?

[Richfez]

If using time as an epoch works OK but just displays incorrectly, can you try using fieldformat to make it appear different without changing the underlying value?

| mysearch | fieldformat "_time"=strftime('_time', "%H:%M:%S")

Let us know if that works.

Happy Splunking!
-Rich

[pbrunel_splunk]

Good idea, but sadly that doesn't work either. On the chart, all points are assigned a value of _time=0. Would post a screenshot, but already exceeded my two img upload limit for this post.

[Anantha123]

Hi, Did you get solution for this. I am also looking something similar . I have time in both X-axis and Y-axis .
Thanks