Deployment Architecture

timechart span not working

New Member
index="myindex" cluster="mycluster" http_request="/"
| bucket _time span=5m
| timechart count by x_forwarded_for useother=false span=5m

the time buckets i'm seeing on this |timechart are half hour buckets instead of 5m buckets. What am I doing wrong?

0 Karma


@zachsisinst I don't think you need line two, because the timechart command takes care of that for you.


If this reply helps you, an upvote would be appreciated.
0 Karma


Hi zachsisinst,

timechart seams to be very picky about the location of the span option, try this:

 | timechart span=5m count by x_forwarded_for useother=false 

Hope this helps ...

cheers, MuS


it is right here

timechart [sep=<string>] [format=<string>] [partial=<bool>] [cont=<bool>] [limit=<int>]
[agg=<stats-agg-term>] [<bin-options>... ]
( (<single-agg> [BY <split-by-clause>] ) | (<eval-expression>) BY <split-by-clause> )

That said the span= or bin option needs to be on the left side of the by split clause 🙂

cheers, MuS


See the updated post

cheers, MuS

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!