I had a x-axis displayed over date_hour. 00,01,02... Is is possible to change it to display on a 3hour basis (00,03,06).
My search query
sourcetype="CurrentWeatherSGMap" Message="Yishun" earliest=@d latest=-0m@m | eval 24-hour=strftime(_time,"%H") | eval Description=case(current_summary="Cloudy", "Fair",current_summary="Rain", "Poor",current_summary="Showers","Poor",current_summary="Passing Showers","Poor",current_summary="Thundery Showers","Poor", current_summary="Partly Cloudy", "Excellent") | chart dc(Description) over 24-hour by Description | eval Fair=if(Excellent==1,"1",Fair) | eval Poor=if(Description==Poor, "1", "1")
Solved using bucket _time span=3h | eval _time=strftime(_time,"%H")
You can make a timechart. Something like..
search... | timechart span=3h count
thanks !!!
Use bucket _time span=3h
If I have a chart, how can I do that ?