Splunk Dev

How to display all months (irrespective of data present for that particular month) on the X-axis when using timechart.

ManoDavidson
New Member

Hi,
I'am relatively new to splunk and exploring Timechart.
I want to display a stacked bar chart which will have count of "state" (for eg: closed, completed,etc) stacked on x-axis on over another.
The x-axis will have all the all the months, irrespective of data present for that month as shown in below image.
[ query:

| eval _time = strptime(opened_at,"%d/%m/%Y")
| timechart count(state) as Value by state
| eval Time=strftime(_time, "%b %Y")
]

alt text

But i want to display all the months here and hence i used below query to display all the months, but im unable to reproduce the stacked bars for unknown reasons.
[query:
| eval _time = strptime(opened_at,"%d/%m/%Y")
| timechart count(state) as Value by state
| eval Time=strftime(_time, "%b %Y")
| table Time,Value
]

alt text
kindly help

Tags (1)
0 Karma

xpac
SplunkTrust
SplunkTrust

Hey, try using | timechart span=1mon - then timechart will not automatically determine which time slots to group, but will build one per month.

ManoDavidson
New Member

Hi xpac,
I tried the same, but I am still getting an empty timechart like the second image i shared.

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...