Splunk Search

How to set x axis time interval for line chart every 1h?

Anud
Path Finder

HI Team,

I am getting 2 hr time span only if i mentioned the 1 or 3 or 4 hours span too in the visualization line chart.
Running below command gives correct time 1hr span but in the visualization facing the issue. attached the reference.

index="xx" * "*"
|eval Day case(like(Date,"%22-AUg-22"),"work",like(Date,"%23-AUg-22"),"work",like(Date,"%24-AUg-22"),"week",like(Date,"%25-AUg-22"),"week",1=1,Day) |timechart span=1h max(YYY) by Day



Anud_0-1663768947297.png

 

Thanks in Advance. 

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

I am getting 2 hr time span only if i mentioned the 1 or 3 or 4 hours span too

Can you explain more what this means?  Maybe some examples where you didn't get 1-hour span and why you believe the code should give 1-hour span? (Also, what is the relationship between getting 2-hour span to the subject line of set time interval every 1hr? What should we look for in the screenshot?)

timechat span=1h always gives 1-hr span on time axis; if your data come in intervals larger than 1 hour, or if certain hours do not have data, you'll get gaps that you must fill in some manner.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...