Reporting

| pivot aggregation minspan

anjafischer
Path Finder

Hello,

is it possible to define something similar to a timechart minspan when using the pivot command?
By playing with the pivot gui, I found a PERIOD command, but it only allows me to specify second, minute, hour, etc. but I cannot specify a MINIMUM span of 5 minutes

Tags (2)

cmeo
Contributor

As it sits it is far less flexible than timechart and according the docs your options are: PERIOD (auto | year | month| day | hour | minute | second and that's it. This may (and should!) improve in future releases. Any comment from the devs?

Just bumped into the same thing myself and been poking various plausible options into it...defaults to 5 min buckets if it doesn't recognise it from the above list.

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Now On Demand Whether you're managing complex deployments or looking to future-proof your data ...

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...