Splunk Search

Default span size change?

unclethan
Path Finder

Is it possible to adjust the default span size for a given time-range?

When using timechart the default span size works fine unless I choose "Last 7 days" , at which point the span size is 1day, meaning I have 7 data points. I would much prefer to have at least 28 datapoints (ie span=6h) to make a meaningful graph.

Where, if anywhere, can I change the default span size for "Last 7 days"?

Tags (2)
0 Karma

lguinn2
Legend

AFAIK, there is no way to change the default span. The times.conf file is where "Last 7 days" is defined - but times.conf does not specify the default span for the timechart command.

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...