timechart span offset

[AI_Wizard]

I have a working chart that uses "timechart span=1w". Is there any way to make the week span go from Monday-Sunday rather than Sunday-Saturday.

Is there a way to modify the default range of span=1w?

[sdaniels · Accepted solution]

I don't think you can modify the default range. Have you tried something like this? I went back 2 weeks ago...you can modify it of course, and change the span to 7d instead of 1w.

... earliest=-2w@w1 latest=-1w@w0 | timechart span=7d ...

[HeinzWaescher]

Hi,

thanks, I tried it out again and now it works for the defined timespan. Is it possible to configure this to run over the whole timespan of the dataset automatically? So that every date is included?

Best
Heinz

[sdaniels]

Yes, earliest is not a command and can't be right after the pipe typically. You can still use earliest but it's going to be used before your first '|' like this:

sourcetype=mysourcetype NOT fail* earliest=-2w@w1 latest=-1w@w0 | timechart...

Sounds like you have | earliest=

You could add | search earliest etc...I think.

[HeinzWaescher]

Hi,

is this still possible in the current Splunk Version? Adding this "... earliest=-2w@w1 latest=-1w@w0" doesn't work for me. It tells me "Unknown search command 'earliest'"

Thanks in advance

Heinz

[AI_Wizard]

That worked perfectly