Choosing the right amount of data to chart

[chowell]

I'm currently indexing DHCP stats, used and free for each scope, every five minutes. Now, if I want to chart this information for say a day it's not a problem. But, if I want to chart this data for longer periods of time, how can I get Splunk to selectively pull the used and free data at the top of every hour, or two hours etc. to cut down the data points? Thanks.

[Ayn]

Splunk's timechart command actually already does this by default until you tell it not to. Among the various arguments you can feed timechart with, there's span and bins. The default number for bins is 100, meaning timechart will always choose the timespan so that no more than 100 intervals will be used. You can change this as you see fit.