The timechart UI expects full times, not days of week. If you're willing to lose the hourly details within a day, something like this should work: index=volume_hourly_summary report="volumebyhour" earliest=-4w@w latest=@w | timechart span=1d sum(count) as TotalVolume | timewrap w series=exact| eval time=strftime(_time, "%A") | fields - _time | table time * (note, this removes _time and uses 'time', and I replaced 1h with 1d) You might have to sort the days of the week. ... View more

We're hosting a contest for the best SCCM app. http://splunk.challengepost.com/ Microsoft SCCM - The first place winner in the Microsoft SCCM app category wins $30,000 and a complimentary pass to .conf 2015 - Splunk's premier annual user conference. Value: approx. $1,695. Innovation - The first place winner in the Innovation category wins $20,000 and a complimentary pass to .conf 2015 - Splunk's premier annual user conference. ... View more

We're hosting a contest for the best SCCM app. http://splunk.challengepost.com/ Microsoft SCCM - The first place winner in the Microsoft SCCM app category wins $30,000 and a complimentary pass to .conf 2015 - Splunk's premier annual user conference. Value: approx. $1,695. Innovation - The first place winner in the Innovation category wins $20,000 and a complimentary pass to .conf 2015 - Splunk's premier annual user conference. ... View more

We're hosting a contest for the best SCCM app. http://splunk.challengepost.com/ Microsoft SCCM - The first place winner in the Microsoft SCCM app category wins $30,000 and a complimentary pass to .conf 2015 - Splunk's premier annual user conference. Value: approx. $1,695. Innovation - The first place winner in the Innovation category wins $20,000 and a complimentary pass to .conf 2015 - Splunk's premier annual user conference. ... View more

http://answers.splunk.com/answers/11566/how-can-i-index-config-files-and-text-documents-as-individual-events that will tell splunk that files of sourcetype "myconfigs" (change name to anything) will treat the whole file as one event. Then tell splunk to index your directory where the files are, and set the sourcetype to "myconfigs" ... View more

Yes, this app works on a field on splunk events. The splunk events can be completely unstructured text. You'd need to index all the documents as separate events, and then use the sentiment app to rate the sentiment of each event (doc). ... View more

Any updates? it's been 2.5 years. thx ... View more

Erik -- a search of "sql" on apps.splunk.com didn't return your app. Users might find your app better if you throw in a few relevant keywords into your apps description: Oracle, Microsoft SQL, Informix, DB2, Sybase and Sybase IQ, Postgres, and MySql. ... View more

bookmark these links. suggest apps you want built. help others build apps. vote up apps that you also want. ... View more

I've uploaded a new version that supports "y" (years). There was a mismatch between the message and the validation code. It assumes 365 to a year, ignoring leap days. ... View more

Comparing week-over-week results used to a pain in Splunk, with complex date calculations. No more. Now there is a better way. I wrote a convenient search command called "timewrap" that does it all, for arbitrary time periods. ... | timechart count span=1d | timewrap w That's it! http://apps.splunk.com/app/1645/ ... View more