Splunk Search

xyseries vs timechart labels

andrewrm
New Member

I've got a chart using xyseries to show multiple data series over time, and it's working fine, except when searching over longer time periods all the date labels are truncated to ...

Using timechart it will only show a subset of dates on the x axis. Is there a way to replicate this using xyseries?

Tags (2)
0 Karma

chimell
Motivator

perhaps the following answer will help you in your task :

Look at this search code which is build with timechart command :

source="airports.csv" |timechart sum(number) as sum by City

The same code search with xyseries command is :

 source="airports.csv" |stats sum(number) as sum by _time , City
         | eval s1="Aaa" | makemv s1 | mvexpand s1
         | eval yval=case(s1=="Aaa",sum) 
         | eval series=City   | xyseries _time,series,yval    

Note that the code : convert timeformat="%a %b %d %Y" ctime(_time) AS c_time is used to change _time command format in the format which is almost like the _time format which appear when we use timechart command.

For more information , click on this link to understand well how use timechart vs xyseries
http://docs.splunk.com/Documentation/Splunk/6.2.0/Search/Chartmultipledataseries

Notice : just replace attentively all my field with your own field .

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...