Hi, Splunk defaults to 1 hour per column, how can I change that to 1 min per column to get a more detailed view?
I get a min interval, if I choose a time below 3 hours ago, but the event I want to search for was 5 hours ago!
You should be a bit more specific about what columns you're talking about. If you're talking about the timeline view above the events list on the search screen, the resolution of that timeline is automatic and you can't change it.
Your default will be based on the time frame that search is running over. If you're charting you can alter the span using span=1m
span=1m
This does not work and I get no results.
Any ideas what I'm doing wrong?
What would the full search line be please?
What is the full search you are currently using (which is not giving you the results you expect)?
