https://community.splunk.com/t5/Splunk-Search/Problems-with-timechart/m-p/59605#M14688 <P>If you want <CODE>timechart</CODE> to operate on a by-hour basis, you should set <CODE>span=1h</CODE>.</P> <PRE><CODE>index=si-security search_name="SI: Bit9 - Count of Execution Blocks (1 Hour)" | timechart span=1h count by signature </CODE></PRE> Thu, 13 Sep 2012 21:16:29 GMT Ayn 2012-09-13T21:16:29Z https://community.splunk.com/t5/Splunk-Search/Problems-with-timechart/m-p/59604#M14687 <P>I have a saved search that runs every hour and saves a count of events into a summary index. A chart on a dashboard displays that data as follows: </P> <P>index=si-security search_name="SI: Bit9 - Count of Execution Blocks (1 Hour)" | timechart count by signature bins=168 </P> <P>The chart is over a 7 day period. I would like the resolution of the chart to show events by hour. Whether I use bins=168 or span=7d, the chart is displaying the sum of the hourly count on a daily basis. </P> <P>What am I doing wrong here?</P> <P>Thx.</P> <P>Craig</P> Thu, 13 Sep 2012 21:07:53 GMT https://community.splunk.com/t5/Splunk-Search/Problems-with-timechart/m-p/59604#M14687 responsys_cm 2012-09-13T21:07:53Z https://community.splunk.com/t5/Splunk-Search/Problems-with-timechart/m-p/59605#M14688 <P>If you want <CODE>timechart</CODE> to operate on a by-hour basis, you should set <CODE>span=1h</CODE>.</P> <PRE><CODE>index=si-security search_name="SI: Bit9 - Count of Execution Blocks (1 Hour)" | timechart span=1h count by signature </CODE></PRE> Thu, 13 Sep 2012 21:16:29 GMT https://community.splunk.com/t5/Splunk-Search/Problems-with-timechart/m-p/59605#M14688 Ayn 2012-09-13T21:16:29Z