Splunk Search

Help for timechart display

ChhayaV
Communicator

alt texthi

this is mt search

index=tm_idx host="server" "finished executing normally" | rex field=_raw "(?i)Process\s\"(?<Processname>\w+)" | rex field=_raw "elapsed\stime\s(?<myduration>\w.\w+)\sseconds" |eval pname=Processname+":"+"Process" |timechart span=1w sum(myduration) by Processname usenull="f"|sort _time

i am displaying processes and their duration by week.I have kept a drop-down list to select a month but when i select month e.g September it gives me chart showing data from 29 august happening same for other months also.

I want to start my chart time from 1st of every month.how can i do it ?
Here i have selected march but i can see february data also which i don't want to.

Thanks

0 Karma

HiroshiSatoh
Champion

(I'm sorry if wrong)
It is extracted from 1st if I set a time range.

alt text

0 Karma

ChhayaV
Communicator

hi
i have given drop down for selecting month and setting date_month as month selected from drop down

0 Karma

ChhayaV
Communicator

i have already posted my search in question and m not extracting month

0 Karma

HiroshiSatoh
Champion

Will you show the search sentence of the dashboard?Because I do not know a point extracting in a month.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought ...

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...