I am working on creating an other than normal bubble chart. -Basically i am plotting 2 string values/categories (y-axis, and color), 1 numeric value ( bubble size), all over time(x-axis). I know this is traditionally NOT what bubble charts are for but this is what the requirement is. Currently i am able to "trick" the chart to plot the data correctly by converting the timestamp into Epoch time and then using epoch as a value number. This plots the data correctly but now i want to be able to view the x axis as the dates not epoch millions values.
I see 2 ways to solve this, create a post-stats command but pre-table command that convert the timestamp into somewhat readable format but still forces Splunk to read it as a numeric value
or
Honestly more preferred do some kind of custom html that would allow me to change the values of the axis that are displayed, and keep the plotting values "behind the curtain"
-my y axis i had to change to string value IDs and would like those displayed as the string value as well as they are currently being displayed as numbers..
index=hidden sourcetype=hidden
| eval z_axis=if("a special calculation that generates a value")
| convert timeformat="%Y-%m-%d %H:%M:%S" mktime(_time) as date
| stats sum(z_axis) as "Score" by "Value", date, ID
| table "Value", date, ID, "Score"![alt text][1]
... View more