topic Re: X-axis time range in Splunk Search

X-axis time range

rameshlpatel — Fri, 20 Jun 2014 13:36:42 GMT

Hi,

I have timechart graph and i am showing that for the day. like Today, Yesterday etc.

Here problem is when I am seeing chart for today at time of 6 AM then its showing only 6 hrs X -axis line and its growing when time passed.

Here I need whole 24 hrs in X-axis without considering at what time I am seeing for the day.

Re: X-axis time range

martin_mueller — Fri, 20 Jun 2014 14:40:33 GMT

Let your search run from @d to @d+d instead of using Today which only runs until now. That way your search will cover 24 hours and the timechart will display the entire day.

Re: X-axis time range

rameshlpatel — Fri, 20 Jun 2014 14:53:01 GMT

Should I have to add @d+d instead of 'now' ? If Yes then I am getting message as 'Earliest Time can be greater then Latest'.

Re: X-axis time range

martin_mueller — Fri, 20 Jun 2014 15:23:04 GMT

Yeah... if you get that message then you may have mixed up the two. Earliest should be @d (00:00 today), and latest should be @d+d (00:00 tomorrow / "24:00" today).

Re: X-axis time range

rameshlpatel — Fri, 20 Jun 2014 15:54:03 GMT

Still in X axis _time showing upto current time.

Re: X-axis time range

martin_mueller — Fri, 20 Jun 2014 16:05:58 GMT

Works for me:

Local time is a bit past 6pm, the chart shows empty all the way until midnight.

Re: X-axis time range

rameshlpatel — Mon, 23 Jun 2014 12:34:50 GMT

I ran same example you given and its showing upto now. Is there any configuration behind this ? I am using SPLUNK 6.1 version.