https://community.splunk.com/t5/Splunk-Search/Timechart-span-by-event-dates/m-p/170814#M48908 <P>I have Splunk monitoring a directory of CSV files that imports events using the date the file was created. This runs fortnightly so my timeline only shows events every 14 days. </P> <P>I'd like to be able to timechart over the previous 6 months, the number of events and have it span the dates from the timeline. I don't want the data to be bucketed together as it is a point in time snapshot and bucketing together will provide inaccurate results. But I want to avoid the peaks and troughs it would create by creating too short a span.</P> <P>Kind Regards,</P> Mon, 04 May 2015 05:46:52 GMT ryanlait 2015-05-04T05:46:52Z https://community.splunk.com/t5/Splunk-Search/Timechart-span-by-event-dates/m-p/170814#M48908 <P>I have Splunk monitoring a directory of CSV files that imports events using the date the file was created. This runs fortnightly so my timeline only shows events every 14 days. </P> <P>I'd like to be able to timechart over the previous 6 months, the number of events and have it span the dates from the timeline. I don't want the data to be bucketed together as it is a point in time snapshot and bucketing together will provide inaccurate results. But I want to avoid the peaks and troughs it would create by creating too short a span.</P> <P>Kind Regards,</P> Mon, 04 May 2015 05:46:52 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-span-by-event-dates/m-p/170814#M48908 ryanlait 2015-05-04T05:46:52Z https://community.splunk.com/t5/Splunk-Search/Timechart-span-by-event-dates/m-p/170815#M48909 <P>You should definitely change the way your data is indexed. Does the data in the csv contain any sort of timestamp? Use that when indexing the data.<BR /> Once your data is indexed, you don't change it.</P> Mon, 04 May 2015 12:20:13 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-span-by-event-dates/m-p/170815#M48909 jeffland 2015-05-04T12:20:13Z