Splunk Search

How to set x axis time interval for line chart every 1h?

Anud
Path Finder

HI Team,

I am getting 2 hr time span only if i mentioned the 1 or 3 or 4 hours span too in the visualization line chart.
Running below command gives correct time 1hr span but in the visualization facing the issue. attached the reference.

index="xx" * "*"
|eval Day case(like(Date,"%22-AUg-22"),"work",like(Date,"%23-AUg-22"),"work",like(Date,"%24-AUg-22"),"week",like(Date,"%25-AUg-22"),"week",1=1,Day) |timechart span=1h max(YYY) by Day



Anud_0-1663768947297.png

 

Thanks in Advance. 

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

I am getting 2 hr time span only if i mentioned the 1 or 3 or 4 hours span too

Can you explain more what this means?  Maybe some examples where you didn't get 1-hour span and why you believe the code should give 1-hour span? (Also, what is the relationship between getting 2-hour span to the subject line of set time interval every 1hr? What should we look for in the screenshot?)

timechat span=1h always gives 1-hr span on time axis; if your data come in intervals larger than 1 hour, or if certain hours do not have data, you'll get gaps that you must fill in some manner.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...