Splunk Search

Why does using "xyseries" command return extra digits attached with the _time label?

smhsplunk
Communicator

I am trying to get a nice Y-m-d on my x axis label using xyseries
but am getting a long value attached with the date

i.e. 2016-07-05T00:00:00.000-04:000

How can I get only the first part in the x-label axis "2016-07-05"

index=street_info  source=street_address
                        | eval mytime=strptime(record_date, "%Y-%m-%d") 
                        | eval _time=mytime 
                        | xyseries _time, street_id, myvalue

even when I use table _time, street_id, value it only shows Y-m-d.
I am not doing sum here, just showing the exact values on the Y-axis against time on X-axis.

please help

THanks

0 Karma
1 Solution

hunters_splunk
Splunk Employee
Splunk Employee

Hi smhsplunk,

You can use appropriate data time format variables to format _time, for example:

strftime(_time, "%b %d, %I")

For detailed information, please refer to documentation:
http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Commontimeformatvariables

Hope this helps. Thanks!
Hunter

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You can use fieldformat command to format the way _time values are shown in chart (without modifying the underlying epoch value)

index=street_info  source=street_address
| eval _time=strptime(record_date, "%Y-%m-%d") 
| xyseries _time, street_id, myvalue 
| fieldformat _time=strftime(_time, "%Y-%m-%d") 
0 Karma

cmerriman
Super Champion

try something like:

index=street_info  source=street_address
                         | eval mytime=strftime(strptime(record_date, "%Y-%m-%dT%H:%M:%S.%3Q%:z"),"%Y-%m-%d")
                         | eval _time=mytime 
                         | xyseries _time, street_id, myvalue

here are docs on time formats and functions:

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables
https://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/CommonEvalFunctions#Date_and_Time...

0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Hi smhsplunk,

You can use appropriate data time format variables to format _time, for example:

strftime(_time, "%b %d, %I")

For detailed information, please refer to documentation:
http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Commontimeformatvariables

Hope this helps. Thanks!
Hunter

0 Karma

smhsplunk
Communicator

This worked | eval _time = strftime(_time, "%Y %b %d")

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...