Splunk Search

How to set x axis time interval for line chart every 1h?

Anud
Path Finder

HI Team,

I am getting 2 hr time span only if i mentioned the 1 or 3 or 4 hours span too in the visualization line chart.
Running below command gives correct time 1hr span but in the visualization facing the issue. attached the reference.

index="xx" * "*"
|eval Day case(like(Date,"%22-AUg-22"),"work",like(Date,"%23-AUg-22"),"work",like(Date,"%24-AUg-22"),"week",like(Date,"%25-AUg-22"),"week",1=1,Day) |timechart span=1h max(YYY) by Day



Anud_0-1663768947297.png

 

Thanks in Advance. 

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

I am getting 2 hr time span only if i mentioned the 1 or 3 or 4 hours span too

Can you explain more what this means?  Maybe some examples where you didn't get 1-hour span and why you believe the code should give 1-hour span? (Also, what is the relationship between getting 2-hour span to the subject line of set time interval every 1hr? What should we look for in the screenshot?)

timechat span=1h always gives 1-hr span on time axis; if your data come in intervals larger than 1 hour, or if certain hours do not have data, you'll get gaps that you must fill in some manner.

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...