X-axis time range

[rameshlpatel]

Hi,

I have timechart graph and i am showing that for the day. like Today, Yesterday etc.

Here problem is when I am seeing chart for today at time of 6 AM then its showing only 6 hrs X -axis line and its growing when time passed.

Here I need whole 24 hrs in X-axis without considering at what time I am seeing for the day.

[martin_mueller]

Let your search run from @d to @d+d instead of using Today which only runs until now. That way your search will cover 24 hours and the timechart will display the entire day.

[rameshlpatel]

I ran same example you given and its showing upto now. Is there any configuration behind this ? I am using SPLUNK 6.1 version.

[martin_mueller]

Works for me:

Local time is a bit past 6pm, the chart shows empty all the way until midnight.

[rameshlpatel]

Still in X axis _time showing upto current time.

[martin_mueller]

Yeah... if you get that message then you may have mixed up the two. Earliest should be @d (00:00 today), and latest should be @d+d (00:00 tomorrow / "24:00" today).

[rameshlpatel]

Should I have to add @d+d instead of 'now' ? If Yes then I am getting message as 'Earliest Time can be greater then Latest'.