Splunk Search

Help for timechart display

ChhayaV
Communicator

alt texthi

this is mt search

index=tm_idx host="server" "finished executing normally" | rex field=_raw "(?i)Process\s\"(?<Processname>\w+)" | rex field=_raw "elapsed\stime\s(?<myduration>\w.\w+)\sseconds" |eval pname=Processname+":"+"Process" |timechart span=1w sum(myduration) by Processname usenull="f"|sort _time

i am displaying processes and their duration by week.I have kept a drop-down list to select a month but when i select month e.g September it gives me chart showing data from 29 august happening same for other months also.

I want to start my chart time from 1st of every month.how can i do it ?
Here i have selected march but i can see february data also which i don't want to.

Thanks

0 Karma

HiroshiSatoh
Champion

(I'm sorry if wrong)
It is extracted from 1st if I set a time range.

alt text

0 Karma

ChhayaV
Communicator

hi
i have given drop down for selecting month and setting date_month as month selected from drop down

0 Karma

ChhayaV
Communicator

i have already posted my search in question and m not extracting month

0 Karma

HiroshiSatoh
Champion

Will you show the search sentence of the dashboard?Because I do not know a point extracting in a month.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...