I am searching for results from a storage report that is generated once an hour. When I generate a a chart for these results, I see only data from 00:00 each day. I want the chart to display the hour by hour data. How do I change the interval of the results to be once hourly rather than once daily?
It isn't 100% clear what you're trying to do, but it sounds like you may want to add span=1h
to your chart
command...
Have you looked at this page?
http://www.splunk.com/base/Documentation/latest/SearchReference/Chart
It isn't 100% clear what you're trying to do, but it sounds like you may want to add span=1h
to your chart
command...
Have you looked at this page?
http://www.splunk.com/base/Documentation/latest/SearchReference/Chart