Splunk Search

x-axis to display 3hours interval

Explorer

I had a x-axis displayed over date_hour. 00,01,02... Is is possible to change it to display on a 3hour basis (00,03,06).

My search query

sourcetype="CurrentWeatherSGMap" Message="Yishun" earliest=@d latest=-0m@m | eval 24-hour=strftime(_time,"%H") | eval Description=case(current_summary="Cloudy", "Fair",current_summary="Rain", "Poor",current_summary="Showers","Poor",current_summary="Passing Showers","Poor",current_summary="Thundery Showers","Poor",  current_summary="Partly Cloudy", "Excellent") | chart dc(Description) over 24-hour by Description | eval Fair=if(Excellent==1,"1",Fair) |  eval Poor=if(Description==Poor, "1", "1")
Tags (2)
1 Solution

Explorer

Solved using bucket time span=3h | eval _time=strftime(time,"%H")

View solution in original post

0 Karma

Explorer

Solved using bucket time span=3h | eval _time=strftime(time,"%H")

View solution in original post

0 Karma

Path Finder

You can make a timechart. Something like..

search... | timechart span=3h count

0 Karma

Explorer

thanks !!!

0 Karma

Champion

Use bucket _time span=3h

Explorer

If I have a chart, how can I do that ?

0 Karma