Splunk Search

Timechart span by event dates

ryanlait
Explorer

I have Splunk monitoring a directory of CSV files that imports events using the date the file was created. This runs fortnightly so my timeline only shows events every 14 days.

I'd like to be able to timechart over the previous 6 months, the number of events and have it span the dates from the timeline. I don't want the data to be bucketed together as it is a point in time snapshot and bucketing together will provide inaccurate results. But I want to avoid the peaks and troughs it would create by creating too short a span.

Kind Regards,

0 Karma

jeffland
SplunkTrust
SplunkTrust

You should definitely change the way your data is indexed. Does the data in the csv contain any sort of timestamp? Use that when indexing the data.
Once your data is indexed, you don't change it.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...