HI Team,
I am getting 2 hr time span only if i mentioned the 1 or 3 or 4 hours span too in the visualization line chart.
Running below command gives correct time 1hr span but in the visualization facing the issue. attached the reference.
index="xx" * "*"
|eval Day case(like(Date,"%22-AUg-22"),"work",like(Date,"%23-AUg-22"),"work",like(Date,"%24-AUg-22"),"week",like(Date,"%25-AUg-22"),"week",1=1,Day) |timechart span=1h max(YYY) by Day
Thanks in Advance.
I am getting 2 hr time span only if i mentioned the 1 or 3 or 4 hours span too
Can you explain more what this means? Maybe some examples where you didn't get 1-hour span and why you believe the code should give 1-hour span? (Also, what is the relationship between getting 2-hour span to the subject line of set time interval every 1hr? What should we look for in the screenshot?)
timechat span=1h always gives 1-hr span on time axis; if your data come in intervals larger than 1 hour, or if certain hours do not have data, you'll get gaps that you must fill in some manner.