Dashboards & Visualizations

dashboard

revanthammineni
Path Finder

Hi Splunkers!

I'm working on an usecase to show a weekly basis of root information of linux data.

index=os user=root sourcetype=linux_secure  action=success app=sshd OR app=su
| eval _time=relative_time(_time, "@w1")
| timechart span=1w count by app

Above query is actaully working but it's giving out other timelines as well, Which is something confusing to my team. I'm looking for just the weekly line chart with dates and no other timeframes shown in the chart.

Help me in solving this case.
Attaching the screenshot. Appreciate your help!

Labels (3)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Data result should be based on your time range selection.

Are you using relative time to snap to week start ? 

have you tried below with required time window?

index=os user=root sourcetype=linux_secure  action=success app=sshd OR app=su
| timechart span=1w@w count by app

 

Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

Data result should be based on your time range selection.

Are you using relative time to snap to week start ? 

have you tried below with required time window?

index=os user=root sourcetype=linux_secure  action=success app=sshd OR app=su
| timechart span=1w@w count by app

 

Happy Splunking!

revanthammineni
Path Finder

Thank you Rajesh!  It helped.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...