When using | timechart by host, which field is represented in the x-axis?

There is no 'date' field used as the x-axis in timechart; Splunk's internal timestamp field is _time, not date.

The 'host' field from the 'by' clause becomes separate series or column headers, not the x-axis.

There is no field simply named 'time' in Splunk; the correct internal timestamp field name is _time with an underscore prefix.

The timechart command internally uses the _time field as the x-axis by design - it is a time-series visualization command. The 'by host' clause splits results into separate series or columns keyed by host values, but _time remains the sole x-axis dimension.