Splunk Search

How to get an Advanced XML timechart to not automatically create its own bins of milliseconds like a Simple XML timechart?

strive
Influencer

Hi,

The timechart in advanced XML creates its own bins of milliseconds. See below
alt text

Whereas in simple XML, it doesn't. See below
alt text

How to get this simple XML behavior in advanced XML?

Thanks,
Strive

0 Karma

strive
Influencer

The span is specified in the search. It is span=1d
That is the minimum span that we can specify

for the search macro, the span value is passed as an argument. There are two possible values: 1d and 7d.
The problem is when span=1d

0 Karma

jlin
Splunk Employee
Splunk Employee

If you do not want to mess around with xml, you could enforce span size for timechart.

http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/timechart

For example:

... | timechart span=1h ...

0 Karma

strive
Influencer

Already span is specified in the search. It is span=1d

That is the minimum span that we can specify

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...