topic Re: How do I change the span based on the time picker selection using timechart? in Splunk Search

How do I change the span based on the time picker selection using timechart?

james_n — Tue, 04 Dec 2018 10:55:14 GMT

HI,

I have a simple query i.e |timechart count by something

The span should change dynamically, for EX: if I select today, the span should be 1h — if I select last months span, it should be 1d — if i select the last 3 months' span, it should be 1mon,

|timechart span=$$ count by something. Plz help me on this.

Re: How do I change the span based on the time picker selection using timechart?

dkeck — Tue, 04 Dec 2018 12:51:33 GMT

Hi,

on a dashboard you could try this:

https://answers.splunk.com/answers/576752/how-to-compare-time-range-picker-to-change-span-of.html

Re: How do I change the span based on the time picker selection using timechart?

FrankVl — Tue, 04 Dec 2018 13:50:35 GMT

What you describe is pretty much the standard behavior of the timechart command. Ar you running into specific situations where you would like to deviate from the automatically chosen span?
http://docs.splunk.com/Documentation/Splunk/7.2.1/SearchReference/Timechart#Default_time_spans

Re: How do I change the span based on the time picker selection using timechart?

james_n — Tue, 04 Dec 2018 13:57:12 GMT

@FrankVI I have a one dashboard which consist of only one visualisation with one time picker. In timepicker if we select 2months, than in visualisation timechart span should be 1mon like that

Re: How do I change the span based on the time picker selection using timechart?

martin_mueller — Tue, 04 Dec 2018 19:47:02 GMT

Use timechart bins=40 to achieve your examples. It'll tell splunk to use 40 or fewer bins - 24 hours in a day, 48 half-hours, pick hours, etc.

Re: How do I change the span based on the time picker selection using timechart?

JohnMurphyAus — Fri, 06 Jan 2023 01:17:30 GMT

Perfect. Thank you!