Splunk Search

How to display a table with time interval of 1 hour, starting at the 30 minute mark?

ankithreddy777
Contributor

I used timechart command to display 1 hour intervals data. I am getting results starting from 00:00 with 1 hour interval. How I can display results with span=1h but 30th minute start time, like 1:30-2:30, 2:30 to 3:30 etc.

0 Karma
1 Solution

somesoni2
Revered Legend

I dont think there is any straight way to do that. Try this workaround

your base search | eval _time=_time-1800 | timechart span=1h ...whatever you've... | eval _time=_time+1800

View solution in original post

somesoni2
Revered Legend

I dont think there is any straight way to do that. Try this workaround

your base search | eval _time=_time-1800 | timechart span=1h ...whatever you've... | eval _time=_time+1800
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...