Splunk Search

In a timechart, how can I display the chosen bucket size?

jgc94131
Explorer

I'm letting timechart choose the proper bucket size, but I want that size to be displayed somewhere. I'd like to be able to have the chosen bucketsize appear in a legend so that when you look at a graph you can understand the Y scale.

0 Karma

somesoni2
Revered Legend

See this run anywhere sample. You should see the span in duration format (1h=01:00:00, 1d=1+00:00:00)

index=_internal | timechart count | delta _time as span | eval span="span=".tostring(span,"duration") | eval {span}=0 | fields - span
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...