https://community.splunk.com/t5/Splunk-Search/If-you-create-a-timechart-with-a-span-and-then-set-quot-earliest/m-p/223641#M65842 <P>Hi,</P> <P>I wonder if someone could help me please with a search I have and I apologize in advance for the newbie question.</P> <P>If you create a timechart with a span, and then you set a 'Earliest' and 'Latest' time period, does one overwrite the other?</P> <P>Could someone perhaps explain the difference please.</P> <P>Many thanks and kind regards</P> <P>Chris</P> Tue, 10 Nov 2015 11:32:07 GMT IRHM73 2015-11-10T11:32:07Z https://community.splunk.com/t5/Splunk-Search/If-you-create-a-timechart-with-a-span-and-then-set-quot-earliest/m-p/223641#M65842 <P>Hi,</P> <P>I wonder if someone could help me please with a search I have and I apologize in advance for the newbie question.</P> <P>If you create a timechart with a span, and then you set a 'Earliest' and 'Latest' time period, does one overwrite the other?</P> <P>Could someone perhaps explain the difference please.</P> <P>Many thanks and kind regards</P> <P>Chris</P> Tue, 10 Nov 2015 11:32:07 GMT https://community.splunk.com/t5/Splunk-Search/If-you-create-a-timechart-with-a-span-and-then-set-quot-earliest/m-p/223641#M65842 IRHM73 2015-11-10T11:32:07Z https://community.splunk.com/t5/Splunk-Search/If-you-create-a-timechart-with-a-span-and-then-set-quot-earliest/m-p/223642#M65843 <P>These settings will not overwrite each other, they do different things.</P> <P>When you set earliest and latest, this is a setting that applies to your entire search and determines from which period of time to fetch results. It's like giving someone the pages of a book in which to look for something, i.e.</P> <PRE><CODE>Go through pages 12 to 25 and count how often you find the word 'hint'. </CODE></PRE> <P>You may want to see these results in different forms, i.e. you might want to see the total of these occurences, or you might want to know how many there are per page, or in the first and last six pages of this "span". When you set a span, you tell the <CODE>timechart</CODE> command how to aggregate its results by defining the size of your (time) buckets. To continue with the above example, this would be like saying </P> <PRE><CODE>Go through pages 12 to 25 and count how often you find the word 'hint', but show me how many of these occurences were on pages 12 to 18 and how many were on pages 19 to 25. </CODE></PRE> <P>In these examples, the pages represent arbitrary time elements. I hope you get what I'm trying to show, feel free to come back with any questions!</P> Tue, 10 Nov 2015 12:05:37 GMT https://community.splunk.com/t5/Splunk-Search/If-you-create-a-timechart-with-a-span-and-then-set-quot-earliest/m-p/223642#M65843 jeffland 2015-11-10T12:05:37Z https://community.splunk.com/t5/Splunk-Search/If-you-create-a-timechart-with-a-span-and-then-set-quot-earliest/m-p/223643#M65844 <P>No, these settings won't overwrite each other, since they are inteded to do different things.</P> <PRE><CODE>yoursearch earliest=-12h latest=-6h | timechart count() </CODE></PRE> <P>This example will show you all results in the timeframe from 12h ago until 6h ago</P> <PRE><CODE>yoursearch earliest=-12h latest=-6h | timechart span=1h count() </CODE></PRE> <P>will do the same, but organize your results in buckets, so you will have accumulated results <EM>per hour</EM> </P> Tue, 10 Nov 2015 12:14:04 GMT https://community.splunk.com/t5/Splunk-Search/If-you-create-a-timechart-with-a-span-and-then-set-quot-earliest/m-p/223643#M65844 DMohn 2015-11-10T12:14:04Z https://community.splunk.com/t5/Splunk-Search/If-you-create-a-timechart-with-a-span-and-then-set-quot-earliest/m-p/223644#M65845 <P>Hi @jeffland, thank you for taking the time to come back to me a very comprehensive and understandable reply.</P> <P>Greatly appreciate!</P> <P>Many thanks and kind regards</P> <P>Chris</P> Tue, 10 Nov 2015 12:45:47 GMT https://community.splunk.com/t5/Splunk-Search/If-you-create-a-timechart-with-a-span-and-then-set-quot-earliest/m-p/223644#M65845 IRHM73 2015-11-10T12:45:47Z https://community.splunk.com/t5/Splunk-Search/If-you-create-a-timechart-with-a-span-and-then-set-quot-earliest/m-p/223645#M65846 <P>Hi @DMohn, thank you very much for taking the time to reply to my post and for the explanation.</P> <P>Very helpful indeed!</P> <P>Kind Regards</P> <P>Chris</P> Wed, 11 Nov 2015 06:13:16 GMT https://community.splunk.com/t5/Splunk-Search/If-you-create-a-timechart-with-a-span-and-then-set-quot-earliest/m-p/223645#M65846 IRHM73 2015-11-11T06:13:16Z