How to change the time format in timechart tooltip? its in AM/PM format but i need to change to 24hr format.
Do we have an answer for this yet?I am still struggling.It would be great if someone could help.
Hello Vaishnavi,
You have one single solution left. Use stats instead of timechart
search...|eval Time=strftime(_time,"%d-%m-%Y %T")|stats count by Time
Hoping this is what you are looking for.
Thanks
That happens because you lose the bucketing and the smart x-axis-labeling performed by the timechart.
The labeling is not nice to look at, but the lack of bucketing severely changes the result of your query. You can do this:
... | bucket _time | eval time = strftime(...) | chart count by time
You will still get the less-than-smart x-axis labeling. That relies on having epoch timestamps, and will automatically fall back to formatting them according to your locale.
Thanks. Time format is changing but the dates on the x-axis look like this --> |...|...|
That timestamp is formatted according to your browser's locale, as seen at the front of the Splunk URL. For example, en-US will render an AM/PM time while en-GB will render a 24h time.
I am still searching for a solution. Please help.
I don't know of any.
is there any way to change time format in tooltip alone?
Renaming the _time
field will indeed break the axis labels, those rely on that field and the _span
field.
Yeah but is it possible to change the time format? i tried changing the format of time as follows,
Mysearch | timechart avg(*) | rename _time as Time | convert timeformat="%H:%M" ctime(Time) AS Time
Time format is getting changed in tooltip but x-axis labels are not getting displayed.