how to write _time function to take the data for all 7 days ( i mean in between days too )

[umsundar2015]

Hi,

I have scenario like having timechart to show spikes for different dates(ex for 7 days).But now it shows same value for all 7 days.

I have intro_max_time and intro_min_time in the format (1477480327.000 which pertains todays date).The condition which i gave is eval _time=info_max_time which takes only today data (ie intro_max_time) .

I want to write this eval function for comparing the data for all the days between this intro_max_time and intro_min_time for getting the spikes.

Please suggest me .

[sundareshr · Accepted solution]

As long as your events have correct values for _time field, you don't need | addinfo | eval _time=intro_max_time. Try this instead.

index=foo sourcetype=bar | timechart span=1d cont=t count by remark_status

[umsundar2015]

i am getting no results .

what is the use of cont=t ???

[sundareshr]

cont: Specifies whether the chart is continuous or not. If set to true, the Search application fills in the time gaps. What do you get when you run this query

index=foo sourcetype=bar earliest=-7d@d | dedup _time | table _time remark_status _raw

http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Timechart

[sundareshr]

Please share your query.

[umsundar2015]

| addinfo | eval _time=intro_max_time |timechart span=1d count by remark_status .

iam selecting time range as last 7 days..