Reporting

| pivot aggregation minspan

anjafischer
Path Finder

Hello,

is it possible to define something similar to a timechart minspan when using the pivot command?
By playing with the pivot gui, I found a PERIOD command, but it only allows me to specify second, minute, hour, etc. but I cannot specify a MINIMUM span of 5 minutes

Tags (2)

cmeo
Contributor

As it sits it is far less flexible than timechart and according the docs your options are: PERIOD (auto | year | month| day | hour | minute | second and that's it. This may (and should!) improve in future releases. Any comment from the devs?

Just bumped into the same thing myself and been poking various plausible options into it...defaults to 5 min buckets if it doesn't recognise it from the above list.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...