monthly timechart of a full year

[asimagu]

I am trying to plot data in a timechart with a span of 1 month. I run the search for the last 12 months until now, but as I only have data from the last 4 months, Splunk snaps the graph to those last months (this only occurs when I convert the simple XML to the advanced mode).

Is there any way to specify a range of 12 months in the X axis?? I was only able to set a fix date as a start and end date, but not a relative one....

This is my XML:

    <earliestTime>-12mon@mon</earliestTime>
  <latestTime>@mon</latestTime>
      <module name="ViewstateAdapter">
        <param name="suppressionList">
          <item>charting.axisLabelsX.majorUnit</item>
          <item>charting.fieldColors</item>
          <item>charting.chart</item>
          <item>charting.axisTitleX.text</item>
        </param>
        <module name="HiddenFieldPicker">
          <param name="strictMode">True</param>
          <module name="JobProgressIndicator">
            <module name="EnablePreview">
              <param name="enable">True</param>
              <param name="display">False</param>
              <module name="HiddenChartFormatter">
                <param name="charting.axisLabelsX.majorUnit">P0Y1M0DT0H0M0S</param>
                <param name="charting.chart">column</param>
                <param name="charting.axisTitleX.text">Month</param>
                <module name="FlashChart">
                  <param name="width">100%</param>
                  <module name="Gimp"/>
                  <module name="ConvertToDrilldownSearch">
                  ...
                  ..

[HiroshiSatoh · Accepted solution]

Please set the time range in the search statement.
･･････ earliest=-12mon@mon latest=@mon ･･････|timechart ･･････

However, I do not erase the warning.Sorry

[asimagu]

would it be possible to get rid of this "warning" now?

'Your timerange was substituted based on your search string'

[asimagu]

it worked!! you are the man!! type it as an aswer and I will approve it 😉

[HiroshiSatoh]

Could it be there is a bug on a combination of time chart and extension XML. What happens if you would embed a time range in the search statement?