Dashboards & Visualizations

dashboard

revanthammineni
Path Finder

Hi Splunkers!

I'm working on an usecase to show a weekly basis of root information of linux data.

index=os user=root sourcetype=linux_secure  action=success app=sshd OR app=su
| eval _time=relative_time(_time, "@w1")
| timechart span=1w count by app

Above query is actaully working but it's giving out other timelines as well, Which is something confusing to my team. I'm looking for just the weekly line chart with dates and no other timeframes shown in the chart.

Help me in solving this case.
Attaching the screenshot. Appreciate your help!

Labels (3)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Data result should be based on your time range selection.

Are you using relative time to snap to week start ? 

have you tried below with required time window?

index=os user=root sourcetype=linux_secure  action=success app=sshd OR app=su
| timechart span=1w@w count by app

 

Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

Data result should be based on your time range selection.

Are you using relative time to snap to week start ? 

have you tried below with required time window?

index=os user=root sourcetype=linux_secure  action=success app=sshd OR app=su
| timechart span=1w@w count by app

 

Happy Splunking!

revanthammineni
Path Finder

Thank you Rajesh!  It helped.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...