Splunk Search

How do I modify the span for timechart to match a chart I'm defining with a time range of "last 7 days"?

goodsellt
Contributor

Hello!

I've been playing around with the timechart command and spanning, however, there is an issue I'm having when I'm trying to use it to match a chart I'm defining with the last 7 days timespan.

I'm trying to have timechart span in such as way that its current period is the same as the last 7 days command, while it is able to go back X number of these periods to build a trend off of. I've been unable to find a combination of span variables and time offsets that matches the time snap of the last 7 days window.

Has anyone with experience doing something like this have a solution that allows you to more precisely define the time snapping?

Edit:
Apologies for the difficulty in understanding this question, I've included the below to help explain what I am getting at:

When I use timechart count span=7d, I receive the following output:
7 Day Span

However, when I use time chart count span=1d, I receive the following output:
1 Day Span

I've marked above in Red the dates which makeup 2016-06-04 in output with the larger span, and so on. What I'm looking for is a way to reverse that calculation, so that instead of starting at the 'earliest' date and making 7 day spans, I'd like it to start at the 'latest' date and make the spans going backwards.

I hope this has made it more clear!

Second edit:

I've attempted to do the double binning solution MuS provided, however the bins are still being created from earliest to latest, instead of latest to earliest which is my desired outcome.

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...