In a chart, I need to set major unit to be one week (i.e adjacant tick marks need to be one week apart). How do I do this?
You should be able to use the span=1w
directive for timechart
. For example: ... | timechart span=1w count
. If this doesn't do it, you can tune the chart properties if you put the chart on a dashboard. See http://www.splunk.com/base/Documentation/latest/Developer/ChartReference as a reference.