topic Splunk chart for time interval in Splunk Search

Splunk chart for time interval

aditya22 — Thu, 23 Apr 2020 13:03:04 GMT

HI ,

I am trying to get the number of hits of users for very 3 minutes .

And am able to generate the chart with below command.

index=jira source="/opt/access_log.2020-04-23" host="xyz | bucket _time span=3m | chart count over user by _time

This generated the table but when viewing the events the events are showing only for a particular time and not time span.

eg:Its showing events for 12:00 but i need 12:00 to 12:03?

Can anyone tell what am i doing wrong?

Re: Splunk chart for time interval

richgalloway — Thu, 23 Apr 2020 13:21:33 GMT

The bucket command "rounds off" the time to the start of the interval. You'll see events for 12:00, 12:03, 12:06, etc. rather than 12:00, 12:01, 12:02 and so on.

You can try timechart, but you'll likely get the same results.

index=jira source="/opt/access_log.2020-04-23" host="xyz" | timechart span=3m count by user

Re: Splunk chart for time interval

aditya22 — Thu, 23 Apr 2020 13:45:22 GMT

Thanks much for the response.

index=jira source="/opt/access_log.2020-04-23" host="xyz | bucket _time span=3m | chart count over user by _time

But getting error.

Error in 'timechart' command: You must specify data field(s) to chart.

Re: Splunk chart for time interval

richgalloway — Thu, 23 Apr 2020 14:14:24 GMT

The error doesn't match the query. There is no timechart command in the query.

Re: Splunk chart for time interval

aditya22 — Thu, 23 Apr 2020 15:22:37 GMT

oh sorry missed that.

This was the query.

index=jira source="/opt/access_log.2020-04-23" host="xyz | timechart span=3m | chart count over user by _time

Re: Splunk chart for time interval

richgalloway — Thu, 23 Apr 2020 17:06:00 GMT

Please look closely at my answer. bucket and chart are replaced by timechart.