I'm using the following to chart job end times over date:
index = ironstream MSGNUM = "IEF404I" ( JOBNAME = TZRPD85 OR TZRPDV9 OR TZRPD35 ) | eval JobEndDate=strftime(_time,"%m/%d/%Y") | eval JobEndTime=strftime(_time,"%H%M") | lookup MF_Jobname_Info.csv JOBNAME OUTPUT Job_Desc | eval JobNameDesc=JOBNAME+" "+Job_Desc | chart earliest(JobEndTime) over JobEndDate by JobNameDesc
The chart is working, except the JobEndTime, meant to be military time, is displaying on the y-axis as comma delimited whole numbers without leading zeroes.
Can I format the y-axis to properly display military time?
Thanks, Steve
The y-axis values have to be numeric and the military time formatting will make it string. I don't think there is a workaround to this.
Sounds like you need the timeline
app
Thank you for the prompt reply. I will investigate the timeline app.
The y-axis values have to be numeric and the military time formatting will make it string. I don't think there is a workaround to this.
Thank you for the prompt reply. When I tried leaving the time alone, hh.mm, the chart would not display anything at all. Any suggestions would be greatly appreciated.
So, you're saying this query is showing blank result in chart (visualization)
index = ironstream MSGNUM = "IEF404I" ( JOBNAME = TZRPD85 OR TZRPDV9 OR TZRPD35 ) | eval JobEndDate=strftime(_time,"%m/%d/%Y") | eval JobEndTime=strftime(_time,"%H.%M") | lookup MF_Jobname_Info.csv JOBNAME OUTPUT Job_Desc | eval JobNameDesc=JOBNAME+" "+Job_Desc | chart earliest(JobEndTime) over JobEndDate by JobNameDesc
Check the table/statistics for this query, it should give column values as decimal numbers
I was wrong above and must have parsed _time with %H:%M. Using %H.%M does show values in both the chart and the table. The y-axis is now showing whole numbers, up to 24 that I'll need to explain are the hours of the day and any hour before noon will not show a leading zero. It'll take some getting used to, but definitely workable.
Thanks for the help.