- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Incorrect Time Range for @d
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a graph that displays the license usage for the day. I have the time parameter say to "@d" because I only want to see for the current day.
The problem I am having is that the counter resets at 12:00AM GMT-1. I am in GMT-5, so the counter resets at 8:00PM local time. I want the counter to reset at 12:00AM GMT-5 or 5:00AM GMT.
Here is a copy of my search:
index=_internal source=*metrics.log group=per_index_thruput series!=_* | eval totalMB = round(kb/1024, 2) | chart sum(totalMB) as total
Time is set to rt@d to rt
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have resolved this issue. It had nothing to do with Splunk, but rather a feature of the environment it is in.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have resolved this issue. It had nothing to do with Splunk, but rather a feature of the environment it is in.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I believe you can fix this by going to Manager -> Your account and then selecting your timezone
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'll give this a try. Unfortunately, there is no way to know until midnight. I will also try to specify the time perameter as "rt@d-4h" and see if that helps. I'll post back tomorrow with my results.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I believe it should also affect your time ranges within searches.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This seems to only change the display. Does this also change the way the application works?
Get Inspired! We’ve Got Validation that Your Hard Work is Paying Off
What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience
Take Your Breath Away with Splunk Risk-Based Alerting (RBA)
