I have a search that is returning the value of a field called num_oracle_batch. I am using the following to get a per_minute count of the number of batches:
timechart span=1m per_minute(num_oracle_batch)
My question is, how can I limit the timechart to only show where the value of num_oracle_batch is an actual number. As it stands, if I choose today from the timepicker, my Y axis is the entire day even though I only had matching search results in only a few minutes in the 9 oclock hour.
So in short, can I dynamically set my timerange based on event results?
You can add cont=f
to the timechart options, making the chart not continuous. With that, your timechart becomes:
timechart span=1m per_minute(num_oracle_batch) cont=f
(From: http://www.splunk.com/base/Documentation/latest/SearchReference/Timechart#Arguments)
Let me know if that doesn't work.
My pleasure. I'd had the same question before, but had never looked up the answer. It's good to know!
Thats exactly what I was looking for. I have been struggling with sub-searches and where clauses to get what I was looking for.
THANKS!