Splunk Search

How do I change the interval of results displayed?

Explorer

I am searching for results from a storage report that is generated once an hour. When I generate a a chart for these results, I see only data from 00:00 each day. I want the chart to display the hour by hour data. How do I change the interval of the results to be once hourly rather than once daily?

Tags (3)
0 Karma
1 Solution

Motivator

It isn't 100% clear what you're trying to do, but it sounds like you may want to add span=1h to your chart command...

Have you looked at this page?

http://www.splunk.com/base/Documentation/latest/SearchReference/Chart

View solution in original post

Motivator

It isn't 100% clear what you're trying to do, but it sounds like you may want to add span=1h to your chart command...

Have you looked at this page?

http://www.splunk.com/base/Documentation/latest/SearchReference/Chart

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!