Splunk Search

Help for timechart display

ChhayaV
Communicator

alt texthi

this is mt search

index=tm_idx host="server" "finished executing normally" | rex field=_raw "(?i)Process\s\"(?<Processname>\w+)" | rex field=_raw "elapsed\stime\s(?<myduration>\w.\w+)\sseconds" |eval pname=Processname+":"+"Process" |timechart span=1w sum(myduration) by Processname usenull="f"|sort _time

i am displaying processes and their duration by week.I have kept a drop-down list to select a month but when i select month e.g September it gives me chart showing data from 29 august happening same for other months also.

I want to start my chart time from 1st of every month.how can i do it ?
Here i have selected march but i can see february data also which i don't want to.

Thanks

0 Karma

HiroshiSatoh
Champion

(I'm sorry if wrong)
It is extracted from 1st if I set a time range.

alt text

0 Karma

ChhayaV
Communicator

hi
i have given drop down for selecting month and setting date_month as month selected from drop down

0 Karma

ChhayaV
Communicator

i have already posted my search in question and m not extracting month

0 Karma

HiroshiSatoh
Champion

Will you show the search sentence of the dashboard?Because I do not know a point extracting in a month.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...