Splunk Search

How do I set the major unit duration to 1 week

New Member

In a chart, I need to set major unit to be one week (i.e adjacant tick marks need to be one week apart). How do I do this?

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

You should be able to use the span=1w directive for timechart. For example: ... | timechart span=1w count. If this doesn't do it, you can tune the chart properties if you put the chart on a dashboard. See http://www.splunk.com/base/Documentation/latest/Developer/ChartReference as a reference.