Dear all
I found that if I use "mysearch | timchart span=1d count by host(timerange is one month)", the x-axis representing time interval will not display all time label (here, one day) but only show every 7 day interval, for example, Friday July 1 2011, Friday July 8 2011, Friday July 15 2011...etc. How to tell splunk to show all span datetime like Friday July 1 2011, Saturday July 2 2011, Sunday July 3 2011..etc. As searching for similar question, it seems others have the same thing.
Thanks in advance
Try using the eval command with the strftime argument. Try this search
mysearch | eval Time = strftime(_time, "%H:%M") | chart span=1d host over Time