Splunk Dev

How to display all months (irrespective of data present for that particular month) on the X-axis when using timechart.

ManoDavidson
New Member

Hi,
I'am relatively new to splunk and exploring Timechart.
I want to display a stacked bar chart which will have count of "state" (for eg: closed, completed,etc) stacked on x-axis on over another.
The x-axis will have all the all the months, irrespective of data present for that month as shown in below image.
[ query:

| eval _time = strptime(opened_at,"%d/%m/%Y")
| timechart count(state) as Value by state
| eval Time=strftime(_time, "%b %Y")
]

alt text

But i want to display all the months here and hence i used below query to display all the months, but im unable to reproduce the stacked bars for unknown reasons.
[query:
| eval _time = strptime(opened_at,"%d/%m/%Y")
| timechart count(state) as Value by state
| eval Time=strftime(_time, "%b %Y")
| table Time,Value
]

alt text
kindly help

Tags (1)
0 Karma

xpac
SplunkTrust
SplunkTrust

Hey, try using | timechart span=1mon - then timechart will not automatically determine which time slots to group, but will build one per month.

ManoDavidson
New Member

Hi xpac,
I tried the same, but I am still getting an empty timechart like the second image i shared.

0 Karma
Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...