topic Re: timechart span offset in Splunk Search

timechart span offset

AI_Wizard — Wed, 25 Jul 2012 18:34:21 GMT

I have a working chart that uses "timechart span=1w". Is there any way to make the week span go from Monday-Sunday rather than Sunday-Saturday.

Is there a way to modify the default range of span=1w?

Re: timechart span offset

sdaniels — Wed, 25 Jul 2012 18:56:14 GMT

I don't think you can modify the default range. Have you tried something like this? I went back 2 weeks ago...you can modify it of course, and change the span to 7d instead of 1w.

... earliest=-2w@w1 latest=-1w@w0 | timechart span=7d ...

Re: timechart span offset

AI_Wizard — Wed, 25 Jul 2012 21:39:43 GMT

That worked perfectly

Re: timechart span offset

HeinzWaescher — Tue, 29 Oct 2013 14:53:15 GMT

Hi,

is this still possible in the current Splunk Version? Adding this "... earliest=-2w@w1 latest=-1w@w0" doesn't work for me. It tells me "Unknown search command 'earliest'"

Thanks in advance

Heinz

Re: timechart span offset

sdaniels — Tue, 29 Oct 2013 23:36:52 GMT

Yes, earliest is not a command and can't be right after the pipe typically. You can still use earliest but it's going to be used before your first '|' like this:

sourcetype=mysourcetype NOT fail* earliest=-2w@w1 latest=-1w@w0 | timechart...

Sounds like you have | earliest=

You could add | search earliest etc...I think.

Re: timechart span offset

HeinzWaescher — Thu, 31 Oct 2013 08:39:10 GMT

Hi,

thanks, I tried it out again and now it works for the defined timespan. Is it possible to configure this to run over the whole timespan of the dataset automatically? So that every date is included?

Best
Heinz