Splunk Search

Changing timechart X axis

appleman
Contributor

Hello,

I want to change X axis on timechart, so I created a dashboard, and added the following option.

My search: index=test sourcetype=type | timechart span=5m sum(A) as A sum(B) as B sum(C) as C sum(D) as D

1
P0Y0M0DT2H0M0S

However, X axis still follows the splunk default auto settings which is 6hours or 4hours.
What else do I need to add on this dashboard to change X axis?

Thank you.


タイムチャートコマンドを利用したサーチで、縦棒グラフをダッシュボードに作成したのですが、下記の設定を加えてもX軸が上手く設定変更されません。
これ以外に何か加える設定等はございますでしょうか。

サーチ文:index=test sourcetype=type | timechart span=5m sum(A) as A sum(B) as B sum(C) as C sum(D) as D

1
P0Y0M0DT2H0M0S

0 Karma

melonman
Motivator

How about this?

index=_internal earliest=-24h@h latest=@h component="Metrics" group="tpool" 
| bucket _time span=1h 
| stats max(workers) as A avg(workers) as B  median(workers) as C stdev(workers) as D by _time 
| rename _time as time 
| eval time=strftime(time, "%Y/%m/%d %H:%M")

alt text

appleman
Contributor

Thank you for sharing.
I've converted my simple xml to advanced, but it didn't work.

0 Karma

somesoni2
Revered Legend
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...