Splunk Search

How to use Timechart Query?

Sweet_Desire123
Engager

Hey guys ,

I need last 30 days stats for the use-cases that did not fire up on the ES console. Below is the query that i designed 

`notable` | search NOT `suppression` | timechart usenull=f span=30d count by rule_name | where _time >= relative_time(now(),"-1mon")

But not getting the desired results as they are only populating one specific date into it. Can someone please refine the above query as i need the trend analysis for the usecases ?

 

Labels (1)
Tags (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

in your timechart you are defined span=1mon => you will get only one time/date to _time field for all events. Then in where expression you are selecting events which have max one month old.

Probably you want to use eg. span=1d or something else to get more granularity to your results?
r. Ismo

smurf
Communicator

Hi,

what time frame do you have defined for the search? I don't mean the one in SPL, but the one that is to the right of where you right your queries.

 

smurf

0 Karma

Sweet_Desire123
Engager

I selected "all time" on the right so that it takes the time defined in the query.

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...