dashboard

[revanthammineni]

Hi Splunkers!

I'm working on an usecase to show a weekly basis of root information of linux data.

index=os user=root sourcetype=linux_secure  action=success app=sshd OR app=su
| eval _time=relative_time(_time, "@w1")
| timechart span=1w count by app

Above query is actaully working but it's giving out other timelines as well, Which is something confusing to my team. I'm looking for just the weekly line chart with dates and no other timeframes shown in the chart.

Help me in solving this case.
Attaching the screenshot. Appreciate your help!

[renjith_nair · Accepted solution]

Data result should be based on your time range selection.

Are you using relative time to snap to week start ? 

have you tried below with required time window?

index=os user=root sourcetype=linux_secure  action=success app=sshd OR app=su
| timechart span=1w@w count by app

[revanthammineni]

Thank you Rajesh!  It helped.