I use the following eval after the pivot to convert the human readable times back to raw time values on 6.2.5 Splunk Enterprise and it works fine. | pivot DataModel_AccessService perf count(TPS) AS "tps" sum(execTime) AS "execTime" SPLITROW _time AS _time PERIOD AUTO SPLITROW host AS hostname | eval _time = strptime(_time, "%Y-%m-%dT%H:%M:%S.%3N%z") | timechart sum(execTime) It looks like Splunk Enterprise 6.3.1 fixes this issue. The time values are not automatically converted to human readable form on my 6.3.1 instance. ... View more

The problem that I see here is that there is no truly "graphable" data in your output. You cannot tell Splunk to use a time-scale on the Y axis. At least not for chart or timechart : by definition, the Y axis must be the numeric result of one of the chart or timechart functions, and none of them return time values. max(Time_of_Day) will work only if Time_of_Day is numeric - otherwise it returns null values. You could do something like this yoursearchhere | timechart span=30m count by Database which will graph the count of events attributable to each database. You might also look at the xyseries command, but I am not sure that it will do what you want, either... ... View more

Never found a complete explanation or solution. I find that when I'm not getting results in a pivot, if I turn on datamodel acceleration sometimes I start getting results in the pivot. ... View more

Hello everyone let me kindly ask you what happens now that this parameter is deprecated (at least on last version 6.3.3)? Could not find anything to replace it - while it raises a Warning into the XML editor best regards Altin ... View more

You are correct in a very general way. Following: http://answers.splunk.com/answers/36792/how-to-sum-numbers-with-commas Using rex: "(? .)" | convert rmcomma(stripped_notional) The result was empty. Using rex: setting field to notional "(? . )"| rex field=stripped_notional mode=sed "s/,//g" Caused a parse error in "//g" Using eval: setting field to stripped_notional and then the eval expression: replace(notional, ",", "") finally worked. ... View more

One thing to make sure of is that you should make sure that there are not any time function in your data model, those will over ride the time restrictions you try and add in a Dashboard. ... View more

Is there possibility to change the shape of scatter plot. I am getting rectangle , i need bubble . Is there possibility to change the size of rectangle in graph. ... View more

"charting.axisLabelsX.majorLabelStyle.rotation" is only supported by the FlashChart renderer. My guess is you're using the JSChart renderer, so you'll need to switch. This is no longer true. FlashChart/AdvancedXML are now deprecated, and majorLabelStyle.rotation will work just fine in highcharts/splunkjs/simplexml. ... View more

Splunk 6 provides support within Simple XML to explicitly hide the axis labels: <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.axisTitleY.visibility">collapsed</option> ... View more