topic Re: Help for timechart display in Splunk Search

Help for timechart display

ChhayaV — Mon, 28 Sep 2020 14:53:10 GMT

this is mt search

index=tm_idx host="server" "finished executing normally" | rex field=_raw "(?i)Process\s\"(?<Processname>\w+)" | rex field=_raw "elapsed\stime\s(?<myduration>\w.\w+)\sseconds" |eval pname=Processname+":"+"Process" |timechart span=1w sum(myduration) by Processname usenull="f"|sort _time

i am displaying processes and their duration by week.I have kept a drop-down list to select a month but when i select month e.g September it gives me chart showing data from 29 august happening same for other months also.

I want to start my chart time from 1st of every month.how can i do it ?
Here i have selected march but i can see february data also which i don't want to.

Thanks

Re: Help for timechart display

HiroshiSatoh — Fri, 04 Oct 2013 04:23:44 GMT

Will you show the search sentence of the dashboard?Because I do not know a point extracting in a month.

Re: Help for timechart display

ChhayaV — Fri, 04 Oct 2013 05:30:28 GMT

i have already posted my search in question and m not extracting month

Re: Help for timechart display

HiroshiSatoh — Fri, 04 Oct 2013 08:20:08 GMT

(I'm sorry if wrong)
It is extracted from 1st if I set a time range.

Re: Help for timechart display

ChhayaV — Fri, 04 Oct 2013 09:06:09 GMT

hi
i have given drop down for selecting month and setting date_month as month selected from drop down