Splunk Search

Help for timechart display

ChhayaV
Communicator

alt texthi

this is mt search

index=tm_idx host="server" "finished executing normally" | rex field=_raw "(?i)Process\s\"(?<Processname>\w+)" | rex field=_raw "elapsed\stime\s(?<myduration>\w.\w+)\sseconds" |eval pname=Processname+":"+"Process" |timechart span=1w sum(myduration) by Processname usenull="f"|sort _time

i am displaying processes and their duration by week.I have kept a drop-down list to select a month but when i select month e.g September it gives me chart showing data from 29 august happening same for other months also.

I want to start my chart time from 1st of every month.how can i do it ?
Here i have selected march but i can see february data also which i don't want to.

Thanks

0 Karma

HiroshiSatoh
Champion

(I'm sorry if wrong)
It is extracted from 1st if I set a time range.

alt text

0 Karma

ChhayaV
Communicator

hi
i have given drop down for selecting month and setting date_month as month selected from drop down

0 Karma

ChhayaV
Communicator

i have already posted my search in question and m not extracting month

0 Karma

HiroshiSatoh
Champion

Will you show the search sentence of the dashboard?Because I do not know a point extracting in a month.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...