https://community.splunk.com/t5/Knowledge-Management/How-do-I-specify-a-time-resolution/m-p/199810#M7804 <P>Hi letharion,</P> <P>it depends on how you show your bars using graphs... if you're using <CODE>timechart</CODE> simply do something like this:</P> <PRE><CODE> your base search | timechart span=1sec count </CODE></PRE> <P>this will give you for each second a bar of all event counts. If you're using <CODE>chart</CODE> or <CODE>stats</CODE> you can do something like this:</P> <PRE><CODE> your base search | bucket _time span=1sec | chart count over _time your base search | bucket _time span=1sec | stats count by _time </CODE></PRE> <P>hope this helps ...</P> <P>cheers, MuS</P> Wed, 18 Jun 2014 12:14:33 GMT MuS 2014-06-18T12:14:33Z https://community.splunk.com/t5/Knowledge-Management/How-do-I-specify-a-time-resolution/m-p/199809#M7803 <P>Normally, the time resolution adjusts itself, seemingly trying to keep the number of bars shown below some "reasonable" limit. So if I search "The last 30 days", I will get bars by the day. If I search "The last 4 hours", I will bars by the minute.</P> <P>How do I adjust that? I want to have a per second resolution, but over a larger time span than just a few minutes.</P> Wed, 18 Jun 2014 10:53:00 GMT https://community.splunk.com/t5/Knowledge-Management/How-do-I-specify-a-time-resolution/m-p/199809#M7803 letharion 2014-06-18T10:53:00Z https://community.splunk.com/t5/Knowledge-Management/How-do-I-specify-a-time-resolution/m-p/199810#M7804 <P>Hi letharion,</P> <P>it depends on how you show your bars using graphs... if you're using <CODE>timechart</CODE> simply do something like this:</P> <PRE><CODE> your base search | timechart span=1sec count </CODE></PRE> <P>this will give you for each second a bar of all event counts. If you're using <CODE>chart</CODE> or <CODE>stats</CODE> you can do something like this:</P> <PRE><CODE> your base search | bucket _time span=1sec | chart count over _time your base search | bucket _time span=1sec | stats count by _time </CODE></PRE> <P>hope this helps ...</P> <P>cheers, MuS</P> Wed, 18 Jun 2014 12:14:33 GMT https://community.splunk.com/t5/Knowledge-Management/How-do-I-specify-a-time-resolution/m-p/199810#M7804 MuS 2014-06-18T12:14:33Z