Splunk chart for time interval

[aditya22]

HI ,

I am trying to get the number of hits of users for very 3 minutes .

And am able to generate the chart with below command.

index=jira source="/opt/access_log.2020-04-23" host="xyz | bucket _time span=3m | chart count over user by _time

This generated the table but when viewing the events the events are showing only for a particular time and not time span.

eg:Its showing events for 12:00 but i need 12:00 to 12:03?

Can anyone tell what am i doing wrong?

[richgalloway · Accepted solution]

The bucket command "rounds off" the time to the start of the interval. You'll see events for 12:00, 12:03, 12:06, etc. rather than 12:00, 12:01, 12:02 and so on.

You can try timechart, but you'll likely get the same results.

index=jira source="/opt/access_log.2020-04-23" host="xyz" | timechart span=3m count by user

[aditya22]

Thanks much for the response.

index=jira source="/opt/access_log.2020-04-23" host="xyz | bucket _time span=3m | chart count over user by _time

But getting error.

Error in 'timechart' command: You must specify data field(s) to chart.

[richgalloway]

The error doesn't match the query. There is no timechart command in the query.

[aditya22]

oh sorry missed that.

This was the query.

index=jira source="/opt/access_log.2020-04-23" host="xyz | timechart span=3m | chart count over user by _time

[richgalloway]

Please look closely at my answer. bucket and chart are replaced by timechart.