Splunk Search

How to create a Timechart that spans 1 week, starts from Monday 00:00

JacobWrdz
Explorer

Hello,

I couldn't find sufficient solution at documentation nor community.

I have to setup timechart, where span=1w, to start at particular day: Monday 00:00.

The query looks like this (I am sorry, I had to anonymity sensitive information):

index=XXX sourcetype= YYY
| eval Alrt_lvl = B_Lvl + Prio_diff
| timechart span=1w count(Alrt_lvl) by Alrt_lvl

Kindly please advise.

Labels (1)
Tags (1)
0 Karma
1 Solution

JacobWrdz
Explorer

@gcusello 

Your advise helped, but with a bit modification. Simple:
| timechart span=1w@w1
works.

Thank you!!!

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @JacobWrdz,

there's a workaround that should run but I never tested,  

index=XXX sourcetype= YYY
| eval Alrt_lvl = B_Lvl + Prio_diff, _time = relative_time(_time,"@w0")
| timechart span=1w count(Alrt_lvl) by Alrt_lvl

 Ciao.

Giuseppe

JacobWrdz
Explorer

@gcusello 

Your advise helped, but with a bit modification. Simple:
| timechart span=1w@w1
works.

Thank you!!!

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...