topic dashboard in Dashboards & Visualizations

dashboard

revanthammineni — Tue, 10 Nov 2020 22:08:53 GMT

Hi Splunkers!

I'm working on an usecase to show a weekly basis of root information of linux data.

index=os user=root sourcetype=linux_secure action=success app=sshd OR app=su
| eval _time=relative_time(_time, "@w1")
| timechart span=1w count by app

Above query is actaully working but it's giving out other timelines as well, Which is something confusing to my team. I'm looking for just the weekly line chart with dates and no other timeframes shown in the chart.

Help me in solving this case.
Attaching the screenshot. Appreciate your help!

Re: dashboard

renjith_nair — Wed, 11 Nov 2020 03:49:01 GMT

Data result should be based on your time range selection.

Are you using relative time to snap to week start ?

have you tried below with required time window?

index=os user=root sourcetype=linux_secure action=success app=sshd OR app=su | timechart span=1w@w count by app

Re: dashboard

revanthammineni — Wed, 11 Nov 2020 08:03:49 GMT

Thank you Rajesh! It helped.