Splunk Search

Timechart over one Month 01.-31.

cschmit1
Explorer

I want to design a new timechart dashboard panel based on a specific search over exact 1 Month (or 30 days)
My search looks like:
sourcetype=”XXX” | timechart count by attack_type

I want the x – axis be formatted like 01.12.15 – 31.12.15 not matter if I got logs > to create a monthly pdf of my dashboard
Similar like this: https://answers.splunk.com/storage/temp/51200-missingdata-20150811.jpg

How can I do this?

0 Karma

DMohn
Motivator

If you want the timeranges to be in cluded in your search, you can use the now() feature to calculate the needed start and end dates.

If your report shall reflect the current month, you can use a search string as follows:

 sourcetype="xxx" earliest="@mon" latest="+1mon@mon" 
 | timechart span=1d count by attack_time

Same would go for the last month:

 sourcetype="xxx" earliest="1-mon@mon" latest="@mon" 
 | timechart span=1d count by attack_time
0 Karma

cschmit1
Explorer
sourcetype="xxx" earliest="@mon" latest="+1mon@mon" 
| timechart span=1d count by attack_time

shows also the range from 05.Nov-12.Nov >> I don´t understand this

0 Karma

HeinzWaescher
Motivator

Set the timrangepicker to select the period/month you want to look at (Date Range -> Between -> select the dates)

Or use the advanced options in the timerange picker:
To see the current month set earliest=-1mon@mon latest=@mon
To see the previous month set earliest=@mon latest=now

 sourcetype="xxx" 
 | timechart span=1d count by attack_time
0 Karma

cschmit1
Explorer

earliest=-1mon@mon latest=now >> shows 01-12.Nov.
But after a few seconds the range from 05.11-12.11 >> I don´t understand this

0 Karma

HeinzWaescher
Motivator

Is there any event with a timestamp <5.11?

0 Karma

cschmit1
Explorer

Yes I got a few events in Oktober but none in November <05.11

0 Karma

HeinzWaescher
Motivator

You are searching the range 1.11 - 31.11, and there is no value to show for 1.11 - 4.11. That's why you don't see values here

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...