Hello,
I have the following timechart, where I plot the count of events from "my_index" **per hour** over the last 7 days by country (for 3 countries).
index="my_index" | timechart cont=FALSE span="1h" sum(count) by country | rename _time as Time | convert timeformat="%m-%d" ctime(Time) -7d@h now
This produces the following output:
![Splunk events per hour timechart][1]
The problem here is: I see no ticks on the timechart's X-axis. What I would like to see is the day and month (formatted as `%m-%d`) for each day.
If I change from 1h to 1d, the X-axis ticks appear... but that's not what I want. I want to plot the events **per hour** over the last 7 days, and show the major ticks for each day.
Digging around in Splunk Answers and the Splunk manual, I have found settings such as "charting.axisLabelsX.majorUnit" and "charting.axisLabelsX.majorTickVisibility", but I can't seem to find any sufficient info on how to make this work.
Any suggestions?
Thank you in advance.
[1]: /storage/temp/217921-splunk.png
↧