Splunk Search

monthly timechart of a full year

asimagu
Builder

I am trying to plot data in a timechart with a span of 1 month. I run the search for the last 12 months until now, but as I only have data from the last 4 months, Splunk snaps the graph to those last months (this only occurs when I convert the simple XML to the advanced mode).

Is there any way to specify a range of 12 months in the X axis?? I was only able to set a fix date as a start and end date, but not a relative one....

This is my XML:

    <earliestTime>-12mon@mon</earliestTime>
  <latestTime>@mon</latestTime>
      <module name="ViewstateAdapter">
        <param name="suppressionList">
          <item>charting.axisLabelsX.majorUnit</item>
          <item>charting.fieldColors</item>
          <item>charting.chart</item>
          <item>charting.axisTitleX.text</item>
        </param>
        <module name="HiddenFieldPicker">
          <param name="strictMode">True</param>
          <module name="JobProgressIndicator">
            <module name="EnablePreview">
              <param name="enable">True</param>
              <param name="display">False</param>
              <module name="HiddenChartFormatter">
                <param name="charting.axisLabelsX.majorUnit">P0Y1M0DT0H0M0S</param>
                <param name="charting.chart">column</param>
                <param name="charting.axisTitleX.text">Month</param>
                <module name="FlashChart">
                  <param name="width">100%</param>
                  <module name="Gimp"/>
                  <module name="ConvertToDrilldownSearch">
                  ...
                  ..
0 Karma
1 Solution

HiroshiSatoh
Champion

Please set the time range in the search statement.
・・・・・・ earliest=-12mon@mon latest=@mon ・・・・・・|timechart ・・・・・・

However, I do not erase the warning.Sorry

View solution in original post

HiroshiSatoh
Champion

Please set the time range in the search statement.
・・・・・・ earliest=-12mon@mon latest=@mon ・・・・・・|timechart ・・・・・・

However, I do not erase the warning.Sorry

asimagu
Builder

would it be possible to get rid of this "warning" now?

'Your timerange was substituted based on your search string'

0 Karma

asimagu
Builder

it worked!! you are the man!! type it as an aswer and I will approve it 😉

0 Karma

HiroshiSatoh
Champion

Could it be there is a bug on a combination of time chart and extension XML. What happens if you would embed a time range in the search statement?

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...