Rename _time field in a TimeChart

When running a timechart splunk search query you may wish to rename the field _time. In order to do this you must first save the search to a dashboard or report. Once saved edit the source and add the following in the panel:

This can be added right before the closing “</chart>” code.

Share This: