Splunk Search

Timechart X Axis - Limiting the Time Range Plot

nibinabr
Communicator

I'm performing a search and plotting a timechart

index=hello_index sourcetype=hello_sourcetype event_id="001" now="12/16/2014:00:00:00" earliest="-1d@d" latest="+2d@d"| ...... |.....|
..| eval _time=time_stamp_I_calculated|timechart sum(something)

I have a search over 72 hrs because I don't exactly know when the event_id "001" happened. I modified _time so that it contains the timestamps of my interest during my search.

Problem
Timechart plots time on the x axis for the 72 hr window(from 15th Dec to 17th Dec).

Question
Is there a way to plot the Xaxis using time range of my interest (from the min value to the max value of _time) and not the 72 hr window.

Tags (1)

tachifelix
Path Finder

try something like this:

 .....|timechart span=1d cont=f sum(something)
0 Karma

somesoni2
Revered Legend

See the documentation on the timechart command here and see the option "cont".

http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Timechart#Optional_arguments

Its defaults to true and forces timechart to span over the timerange. Making it false or f will trim your chart from min to max value of _time.

nibinabr
Communicator

I'm not exactly sure why cont didn't work well for me. I solved this issue by doing a sub search that returns the earliest and latest time and use that as the earliest and latest values for the parent search.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...