Splunk Search

timechart span offset

AI_Wizard
New Member

I have a working chart that uses "timechart span=1w". Is there any way to make the week span go from Monday-Sunday rather than Sunday-Saturday.

Is there a way to modify the default range of span=1w?

Tags (1)
0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

I don't think you can modify the default range. Have you tried something like this? I went back 2 weeks ago...you can modify it of course, and change the span to 7d instead of 1w.

... earliest=-2w@w1 latest=-1w@w0 | timechart span=7d ...

View solution in original post

sdaniels
Splunk Employee
Splunk Employee

I don't think you can modify the default range. Have you tried something like this? I went back 2 weeks ago...you can modify it of course, and change the span to 7d instead of 1w.

... earliest=-2w@w1 latest=-1w@w0 | timechart span=7d ...

HeinzWaescher
Motivator

Hi,

thanks, I tried it out again and now it works for the defined timespan. Is it possible to configure this to run over the whole timespan of the dataset automatically? So that every date is included?

Best
Heinz

0 Karma

sdaniels
Splunk Employee
Splunk Employee

Yes, earliest is not a command and can't be right after the pipe typically. You can still use earliest but it's going to be used before your first '|' like this:

sourcetype=mysourcetype NOT fail* earliest=-2w@w1 latest=-1w@w0 | timechart...

Sounds like you have | earliest=

You could add | search earliest etc...I think.

0 Karma

HeinzWaescher
Motivator

Hi,

is this still possible in the current Splunk Version? Adding this "... earliest=-2w@w1 latest=-1w@w0" doesn't work for me. It tells me "Unknown search command 'earliest'"

Thanks in advance

Heinz

0 Karma

AI_Wizard
New Member

That worked perfectly

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...