We have a dashboard panel showing network traffic. I want to override the default values used by Splunk.
e.g.
last 60min: span=1m
last 24h: span=15m
last 7 days: span=1h
last 30days: span=4h
all time: span=1d
Our first version of the panel used a hardcoded span of 15m, but obviously that won't work well when you're looking at 30days or all time.
Hello
This subquery will calculate the most granular possible span value for a given time range:
| timechart [ search index=_internal | head 1 | addinfo | eval span=ceil((info_max_time-info_min_time)/1000)."s" | return span] count
If you want exactly as you asked for, you can use this one instead:
| timechart [ search index=_internal | head 1 | addinfo | eval timerange= info_max_time-info_min_time | eval span=case(timerange<4000,"1m",timerange<90000,"15m",timerange<606000,"1h",timerange<2700000,"4h",1=1,"1d") | return span] count
Hope it helps
Hello
This subquery will calculate the most granular possible span value for a given time range:
| timechart [ search index=_internal | head 1 | addinfo | eval span=ceil((info_max_time-info_min_time)/1000)."s" | return span] count
If you want exactly as you asked for, you can use this one instead:
| timechart [ search index=_internal | head 1 | addinfo | eval timerange= info_max_time-info_min_time | eval span=case(timerange<4000,"1m",timerange<90000,"15m",timerange<606000,"1h",timerange<2700000,"4h",1=1,"1d") | return span] count
Hope it helps
Thanks. Your second solution was perfect