Splunk Search

In a timechart, how can I display the chosen bucket size?

jgc94131
Explorer

I'm letting timechart choose the proper bucket size, but I want that size to be displayed somewhere. I'd like to be able to have the chosen bucketsize appear in a legend so that when you look at a graph you can understand the Y scale.

0 Karma

somesoni2
Revered Legend

See this run anywhere sample. You should see the span in duration format (1h=01:00:00, 1d=1+00:00:00)

index=_internal | timechart count | delta _time as span | eval span="span=".tostring(span,"duration") | eval {span}=0 | fields - span
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...