Splunk Search

How to customize time intervals for time range in Time Range Picker

tkadale
Path Finder

I want to customize time intervals for the options in Time Range Picker.
For Ex- If I select Last 7 days from drop down, currently time interval is 1 day. but I want to make it Every 5 hours whenever I select this option from drop down.
Can I configure my own time intervals for particular option in Time Range Picker drop-down.
Can I configure it in times.conf??
Please help me!

Thanks in Advance!

Tags (1)

mw
Splunk Employee
Splunk Employee

Please clarify whether you want to select a 5 hour time period for a search (i.e. all results are from within the last 5 hours), or you want to have the results bucketed into 5 hour spans.

0 Karma

Ant1D
Motivator

If you are asking for your results over the last 7 days to be placed into time buckets of every 5 hours then my understanding is that this cannot be configured using times.conf

You could achieve this by adding a timechart span=5h at the end of your search

0 Karma

Ant1D
Motivator

Not that I am aware of. This would be useful though. I think from a stance of flexibility, using the timechart span command is the best way forward for now until Splunk integrates this functionality into the software.

0 Karma

tkadale
Path Finder

Thanks for you reply!
But I don't want to hard coat it in the XML because I want the time bucket of 5 hours only if user select time range Last 7 Days from Time Range Picker.
I want different time bucket if user select "Previous Month" from time range picker.
Can I customize time bucket for different time ranges??

0 Karma

hjwang
Contributor

hi~i don't know what you really want. Maybe you can pipe your search to timechart count span=5h to do this

0 Karma

tkadale
Path Finder

I want to configure it for my app. I don't want it for a single graph.I don't want it in XML file.
I want to have my own time interval setting for options in Time Range Picker.
Ex- I want to set time interval as 5 hours for the graph whenever I select Last 7 days from Time Range Picker.
Can I configure it in stanza for Last 7 Days in times.conf??

0 Karma
Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...