Hi,
I am sorry I am very new to the splunk and I am struggling with the results I want to get.
I have a query that produces desired (kind of.. In visualization, months are still not in chronological order) result as bar chart without any effort. When I convert that to line chart, my grouping by month is removed and I get result for each day as seen below:
Query:
QUERY | eval Date=strftime('_time',"%Y-%m") | timechart count by Click | sort _time Desc
Visualization looks perfect as bar chart:
As soon as I select Line chart, My X-Axis displays chart by individual date and not grouped by month as seen below: 2:
Can someone please tell me how to group my data by month in a line OR any other chart?
Also how can I display my chart starting from latest?
Thanks
Hi @poete,
Thanks for your answer. It worked like a charm.
Now only problem remains is that, it starts with least to greatest. I want to start my graph from current year-month and then in the past. Currently if I set time range for 365 days, it starts at February 2019 and then goes on. I want it to start with February 2020.
Thanks again
Andy
Hello @andy222,
please modify your query as follows :
QUERY | timechart count by Click span=1mon
and find all information about span here https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Timechart and here https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Timechart#Span_options