Splunk Search

How to change the _time to X-axis in a time chart table?

parameshjava
Explorer

Currently I am using the search below to generate an error codes report in my application.

source="log_file_name.log" | rex "(?<errorCode>OPT-\w{6})" | timechart span=1d count by errorCode usenull=f useother=f | rename _time as Time | eval Time=strftime(Time, "%d-%b-%Y") | sort date_numericmonth desc

It's showing the results as below.
Error codes table

When there are more error codes, then it's currently required to scroll the horizontal line bar. Instead, is there any possibility to switch Time to the X-Axis and Error Codes on Y-Axis in the table?

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Try this

source="log_file_name.log" | rex "(?<errorCode>OPT-w{6})" | chart count over errorCode by tiime usenull=f useother=f | rename _time as Time | eval Time=strftime(Time, "%d-%b-%Y") | sort date_numericmonth desc

Adjust the search according to your requirement . For reference : http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/chart

Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

Try this

source="log_file_name.log" | rex "(?<errorCode>OPT-w{6})" | chart count over errorCode by tiime usenull=f useother=f | rename _time as Time | eval Time=strftime(Time, "%d-%b-%Y") | sort date_numericmonth desc

Adjust the search according to your requirement . For reference : http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/chart

Happy Splunking!
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...