Splunk Search

timespan not providing desired result

praddasg
Path Finder

alt textalt textHello,

I am trying to have timespan to show results for every 2 mins but it seems to reflect the default of 5 mins

earliest=-180m
index=apps
sourcetype=pos-generic:prod
"com.grubhub.pos.generic.orders.service.OrdersService: Received request to change status"
partner_account_name="Level Up"
| dedup orderId
| search status=REJECTED
| timechart count by status minspan=2m

Tags (1)
0 Karma
1 Solution

efavreau
Motivator

Try this instead for your last line:

| timechart span=2m count by status
###

If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

efavreau
Motivator

Try this instead for your last line:

| timechart span=2m count by status
###

If this reply helps you, an upvote would be appreciated.
0 Karma

praddasg
Path Finder

ahh i was using at the wrong place, thank you it works.

0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...