Splunk Search

How to customize time intervals for time range in Time Range Picker

tkadale
Path Finder

I want to customize time intervals for the options in Time Range Picker.
For Ex- If I select Last 7 days from drop down, currently time interval is 1 day. but I want to make it Every 5 hours whenever I select this option from drop down.
Can I configure my own time intervals for particular option in Time Range Picker drop-down.
Can I configure it in times.conf??
Please help me!

Thanks in Advance!

Tags (1)

mw
Splunk Employee
Splunk Employee

Please clarify whether you want to select a 5 hour time period for a search (i.e. all results are from within the last 5 hours), or you want to have the results bucketed into 5 hour spans.

0 Karma

Ant1D
Motivator

If you are asking for your results over the last 7 days to be placed into time buckets of every 5 hours then my understanding is that this cannot be configured using times.conf

You could achieve this by adding a timechart span=5h at the end of your search

0 Karma

Ant1D
Motivator

Not that I am aware of. This would be useful though. I think from a stance of flexibility, using the timechart span command is the best way forward for now until Splunk integrates this functionality into the software.

0 Karma

tkadale
Path Finder

Thanks for you reply!
But I don't want to hard coat it in the XML because I want the time bucket of 5 hours only if user select time range Last 7 Days from Time Range Picker.
I want different time bucket if user select "Previous Month" from time range picker.
Can I customize time bucket for different time ranges??

0 Karma

hjwang
Contributor

hi~i don't know what you really want. Maybe you can pipe your search to timechart count span=5h to do this

0 Karma

tkadale
Path Finder

I want to configure it for my app. I don't want it for a single graph.I don't want it in XML file.
I want to have my own time interval setting for options in Time Range Picker.
Ex- I want to set time interval as 5 hours for the graph whenever I select Last 7 days from Time Range Picker.
Can I configure it in stanza for Last 7 Days in times.conf??

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...