Splunk Search

Is there any way to set a higher default "bins=xxx" for timechart setting?

Richfez
SplunkTrust
SplunkTrust

I know I can override the default bins=100 in any particular search. Is there any way to set something slightly higher as the default?

Use case: The majority of our timechart based searches bucket reasonably well, but both Weekly and Business Weekly reports should not trigger a bump to the next bin size (daily) and should remain hourly. Unfortunately, I don't wish to have to add "bins=170" or bins="200" to all searches and would like a way to set it as the default, which sounds like a very reasonable knob that ought to be available. I can't find it though.

I can't just set span=1h because the searches may vary between "show me today" to "show me the previous year." I need to keep the dynamic span aspect, just have a few more buckets available before it kicks me into larger buckets.

1 Solution

MarioM
Motivator

have you looked at this parameter in limits.conf:

[discretize]
* This stanza set attributes for bin/bucket/discretize.

default_time_bins = <integer>
* When discretizing time for timechart or explicitly via bin, the default bins to use if no span or bins is specified.
* Defaults to 100

View solution in original post

MarioM
Motivator

have you looked at this parameter in limits.conf:

[discretize]
* This stanza set attributes for bin/bucket/discretize.

default_time_bins = <integer>
* When discretizing time for timechart or explicitly via bin, the default bins to use if no span or bins is specified.
* Defaults to 100

Richfez
SplunkTrust
SplunkTrust

Works perfectly. After double-checking and all that, I added

[discretize]
default_time_bins = 200

to /opt/splunk/etc/system/local/limits.conf, restarted splunk and now weekly searches default to hourly bins. Perfect.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...