Splunk Search

How to display a table with time interval of 1 hour, starting at the 30 minute mark?

ankithreddy777
Contributor

I used timechart command to display 1 hour intervals data. I am getting results starting from 00:00 with 1 hour interval. How I can display results with span=1h but 30th minute start time, like 1:30-2:30, 2:30 to 3:30 etc.

0 Karma
1 Solution

somesoni2
Revered Legend

I dont think there is any straight way to do that. Try this workaround

your base search | eval _time=_time-1800 | timechart span=1h ...whatever you've... | eval _time=_time+1800

View solution in original post

somesoni2
Revered Legend

I dont think there is any straight way to do that. Try this workaround

your base search | eval _time=_time-1800 | timechart span=1h ...whatever you've... | eval _time=_time+1800
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...