docs http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Timewrap
Can I just do a timewrap on just 1 field/column?
e.g. .... search | timewrap column1 d series=exact
I have a search that gives me 3 cloumns - _time column 1 and column 2. I just want to do a timewrap on column1 and leave column 2 as is?
Let me know if more info is required.
https://docs.splunk.com/Documentation/Splunk/7.1.0/SearchReference/Timewrap
so this says what you would do
| timechart field span=1d| timewrap 1week
1week here will give "Each table column, which is the series, is 1 week of time.", or 1day or d will give you a column of 1 day worth of values.
| timechart field span=1d| timewrap 1week
my example is: .... timechart spand=h sum(kpi1) as column1 sum(kpi2) as column2 | timewrap column1 d series=exact
I just want to do the timewrap on column1. I don't think it can be done based on the docs.