Splunk Search

Can you help me with a query that uses the latest function with a timechart command?

james_n
Path Finder

HI,

I have a query index=something | timechart latest(fieldA) as datavalues by dataNames.

when i select the time duration Today or Yesterday up to last 30days , it's working fine. If I select the last 3 months, it's displaying the wrong results.

Can you please help me on this?

0 Karma

bjoernjensen
Contributor

Hey,

How do you select "last 3 months"? Do you use any time snapping:
timechart_time_snipping

you can force the time using earliest and latest as filter:
index=something earliest=-3mon latest=now

Which is different to:
index=something earliest=-3mon@m latest=@m

Cheerz,
Björn

0 Karma

james_n
Path Finder

@skoelpin yes same data same timestamp from last one year onwards

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Can you post a screenshot of what you see and explain what you're looking to get?

Are you referring to different time spans as you extend the time period?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Have you confirmed your timestamp is correct from 3 months ago?

0 Karma

adonio
Ultra Champion

timechart has auto spaning depends on the time picker
see here: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/timechart

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...