Splunk Search

Can I just do a timewrap on just 1 field/column?

HattrickNZ
Motivator

docs http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Timewrap

Can I just do a timewrap on just 1 field/column?
e.g. .... search | timewrap column1 d series=exact

I have a search that gives me 3 cloumns - _time column 1 and column 2. I just want to do a timewrap on column1 and leave column 2 as is?

Let me know if more info is required.

Tags (1)
0 Karma

kaitlyngarratle
Engager

https://docs.splunk.com/Documentation/Splunk/7.1.0/SearchReference/Timewrap

so this says what you would do
| timechart field span=1d| timewrap 1week

HattrickNZ
Motivator

1week here will give "Each table column, which is the series, is 1 week of time.", or 1day or d will give you a column of 1 day worth of values.
| timechart field span=1d| timewrap 1week

my example is: .... timechart spand=h sum(kpi1) as column1 sum(kpi2) as column2 | timewrap column1 d series=exact

I just want to do the timewrap on column1. I don't think it can be done based on the docs.

0 Karma
Get Updates on the Splunk Community!

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...