I have set up an accelerated summary for a report with summary range of 1 month. I want to report summary by week. When I run a search with "timechart bins=4 span=1week...", I get 4 to 5 bins: one per week. But then I also get some other bins with days in addition to weekly bins in my search results. I don't want to get individual days that are outside the week boundaries. I never want to see data summarized by any granularity lower than a week. Do I need to change my acceleration setup or my timechart command in the search?
Splunk doc says to let them figure out the correct timespan. But I feel that they are summarizing at too low of a granular level (10min, 1hr). Regardless, I want the timechart command to show correct results with proper weekly bins.
What is wrong here?
Here is how my summary detail looks:
Details Learn more.
Summarization Load 0.0000
Access Count 0 Last Access: Never
Size on Disk 7.83MB
Summary Range 30 days
Timespans 10min, 1d, 1h, 1mon
Buckets 506
Chunks 1002
... View more