topic Re: Splunk Timechart span in Dashboards & Visualizations

Splunk Timechart span

Splunk3 — Tue, 04 Jan 2022 12:13:42 GMT

Hi I am trying to count the number of jobs till now and want to show the daily trend using timechart command. Not able to get , may be I am messing up with span option

for eg.. total jobs executed till now is 100 and there is trend of 10 jobs increased today

tomorrow it should show 110 and trend of tomorrows increase job

command - index=.......... projects="*" job_id="*" | dedup job_id | timechart span=60d count

In picture you can see that total events are shown 1688 , I need that as single value and daily trend over it

Re: Splunk Timechart span

ITWhisperer — Tue, 04 Jan 2022 12:20:06 GMT

Shouldn't span=1d if you want daily trends?

Re: Splunk Timechart span

Splunk3 — Tue, 04 Jan 2022 12:33:44 GMT

Yes, but here I need total no of jobs executed till now i.e 1688 in this case( see the total no of events ) and on that I want daily trend

Re: Splunk Timechart span

ITWhisperer — Tue, 04 Jan 2022 12:43:54 GMT

Re: Splunk Timechart span

Splunk3 — Tue, 04 Jan 2022 14:16:42 GMT

Thank you it worked -:)