I am trying to get a nice Y-m-d on my x axis label using xyseries
but am getting a long value attached with the date
i.e. 2016-07-05T00:00:00.000-04:000
How can I get only the first part in the x-label axis "2016-07-05"
index=street_info source=street_address
| eval mytime=strptime(record_date, "%Y-%m-%d")
| eval _time=mytime
| xyseries _time, street_id, myvalue
even when I use table _time, street_id, value it only shows Y-m-d.
I am not doing sum here, just showing the exact values on the Y-axis against time on X-axis.
please help
THanks
Hi smhsplunk,
You can use appropriate data time format variables to format _time, for example:
strftime(_time, "%b %d, %I")
For detailed information, please refer to documentation:
http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Commontimeformatvariables
Hope this helps. Thanks!
Hunter
You can use fieldformat command to format the way _time values are shown in chart (without modifying the underlying epoch value)
index=street_info source=street_address
| eval _time=strptime(record_date, "%Y-%m-%d")
| xyseries _time, street_id, myvalue
| fieldformat _time=strftime(_time, "%Y-%m-%d")
try something like:
index=street_info source=street_address
| eval mytime=strftime(strptime(record_date, "%Y-%m-%dT%H:%M:%S.%3Q%:z"),"%Y-%m-%d")
| eval _time=mytime
| xyseries _time, street_id, myvalue
here are docs on time formats and functions:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables
https://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/CommonEvalFunctions#Date_and_Time...
Hi smhsplunk,
You can use appropriate data time format variables to format _time, for example:
strftime(_time, "%b %d, %I")
For detailed information, please refer to documentation:
http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Commontimeformatvariables
Hope this helps. Thanks!
Hunter
This worked | eval _time = strftime(_time, "%Y %b %d")