Splunk Search

xyseries vs timechart labels

New Member

I've got a chart using xyseries to show multiple data series over time, and it's working fine, except when searching over longer time periods all the date labels are truncated to ...

Using timechart it will only show a subset of dates on the x axis. Is there a way to replicate this using xyseries?

Tags (2)
0 Karma


perhaps the following answer will help you in your task :

Look at this search code which is build with timechart command :

source="airports.csv" |timechart sum(number) as sum by City

The same code search with xyseries command is :

 source="airports.csv" |stats sum(number) as sum by _time , City
         | eval s1="Aaa" | makemv s1 | mvexpand s1
         | eval yval=case(s1=="Aaa",sum) 
         | eval series=City   | xyseries _time,series,yval    

Note that the code : convert timeformat="%a %b %d %Y" ctime(_time) AS c_time is used to change _time command format in the format which is almost like the _time format which appear when we use timechart command.

For more information , click on this link to understand well how use timechart vs xyseries

Notice : just replace attentively all my field with your own field .

Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...