Splunk Search

Can I just do a timewrap on just 1 field/column?

HattrickNZ
Motivator

docs http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Timewrap

Can I just do a timewrap on just 1 field/column?
e.g. .... search | timewrap column1 d series=exact

I have a search that gives me 3 cloumns - _time column 1 and column 2. I just want to do a timewrap on column1 and leave column 2 as is?

Let me know if more info is required.

Tags (1)
0 Karma

kaitlyngarratle
Engager

https://docs.splunk.com/Documentation/Splunk/7.1.0/SearchReference/Timewrap

so this says what you would do
| timechart field span=1d| timewrap 1week

HattrickNZ
Motivator

1week here will give "Each table column, which is the series, is 1 week of time.", or 1day or d will give you a column of 1 day worth of values.
| timechart field span=1d| timewrap 1week

my example is: .... timechart spand=h sum(kpi1) as column1 sum(kpi2) as column2 | timewrap column1 d series=exact

I just want to do the timewrap on column1. I don't think it can be done based on the docs.

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...