https://community.splunk.com/t5/Splunk-Search/Timechart-and-Timepicker/m-p/76552#M181476 <P>I am running a search like so:</P> <PRE><CODE>sourcetype="stuff here" | timechart span=1h sum(bytes) as Total by limit=10 username useother=f </CODE></PRE> <P>Is it possible to change the span based on a timepicker? </P> <P>For instance, if timepicker is 15 minutes, then my span should be like 3 minutes. If it's 30 days, then I want the span to be 1d, etc.</P> <P>Maybe I need to use a different method?</P> Thu, 07 Apr 2011 20:02:26 GMT jgauthier 2011-04-07T20:02:26Z https://community.splunk.com/t5/Splunk-Search/Timechart-and-Timepicker/m-p/76552#M181476 <P>I am running a search like so:</P> <PRE><CODE>sourcetype="stuff here" | timechart span=1h sum(bytes) as Total by limit=10 username useother=f </CODE></PRE> <P>Is it possible to change the span based on a timepicker? </P> <P>For instance, if timepicker is 15 minutes, then my span should be like 3 minutes. If it's 30 days, then I want the span to be 1d, etc.</P> <P>Maybe I need to use a different method?</P> Thu, 07 Apr 2011 20:02:26 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-and-Timepicker/m-p/76552#M181476 jgauthier 2011-04-07T20:02:26Z https://community.splunk.com/t5/Splunk-Search/Timechart-and-Timepicker/m-p/76553#M181477 <P>If you simply omit the span in the timechart command, it will choose an appropriate interval. Similarly, instead of specifying a span, you can specify a maximum number of bins to split, e.g. try <CODE>bins=40</CODE> instead of <CODE>span=1h</CODE></P> Thu, 07 Apr 2011 20:25:30 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-and-Timepicker/m-p/76553#M181477 gkanapathy 2011-04-07T20:25:30Z https://community.splunk.com/t5/Splunk-Search/Timechart-and-Timepicker/m-p/76554#M181478 <P>Perfect. Thank you!</P> Thu, 07 Apr 2011 20:46:56 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-and-Timepicker/m-p/76554#M181478 jgauthier 2011-04-07T20:46:56Z