Splunk Search

How to use Timechart Query?

Sweet_Desire123
Engager

Hey guys ,

I need last 30 days stats for the use-cases that did not fire up on the ES console. Below is the query that i designed 

`notable` | search NOT `suppression` | timechart usenull=f span=30d count by rule_name | where _time >= relative_time(now(),"-1mon")

But not getting the desired results as they are only populating one specific date into it. Can someone please refine the above query as i need the trend analysis for the usecases ?

 

Labels (1)
Tags (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

in your timechart you are defined span=1mon => you will get only one time/date to _time field for all events. Then in where expression you are selecting events which have max one month old.

Probably you want to use eg. span=1d or something else to get more granularity to your results?
r. Ismo

smurf
Communicator

Hi,

what time frame do you have defined for the search? I don't mean the one in SPL, but the one that is to the right of where you right your queries.

 

smurf

0 Karma

Sweet_Desire123
Engager

I selected "all time" on the right so that it takes the time defined in the query.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...