Splunk Search

timechart span offset

AI_Wizard
New Member

I have a working chart that uses "timechart span=1w". Is there any way to make the week span go from Monday-Sunday rather than Sunday-Saturday.

Is there a way to modify the default range of span=1w?

Tags (1)
0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

I don't think you can modify the default range. Have you tried something like this? I went back 2 weeks ago...you can modify it of course, and change the span to 7d instead of 1w.

... earliest=-2w@w1 latest=-1w@w0 | timechart span=7d ...

View solution in original post

sdaniels
Splunk Employee
Splunk Employee

I don't think you can modify the default range. Have you tried something like this? I went back 2 weeks ago...you can modify it of course, and change the span to 7d instead of 1w.

... earliest=-2w@w1 latest=-1w@w0 | timechart span=7d ...

HeinzWaescher
Motivator

Hi,

thanks, I tried it out again and now it works for the defined timespan. Is it possible to configure this to run over the whole timespan of the dataset automatically? So that every date is included?

Best
Heinz

0 Karma

sdaniels
Splunk Employee
Splunk Employee

Yes, earliest is not a command and can't be right after the pipe typically. You can still use earliest but it's going to be used before your first '|' like this:

sourcetype=mysourcetype NOT fail* earliest=-2w@w1 latest=-1w@w0 | timechart...

Sounds like you have | earliest=

You could add | search earliest etc...I think.

0 Karma

HeinzWaescher
Motivator

Hi,

is this still possible in the current Splunk Version? Adding this "... earliest=-2w@w1 latest=-1w@w0" doesn't work for me. It tells me "Unknown search command 'earliest'"

Thanks in advance

Heinz

0 Karma

AI_Wizard
New Member

That worked perfectly

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...