HI,
I have a simple query i.e |timechart count by something
The span should change dynamically, for EX: if I select today, the span should be 1h — if I select last months span, it should be 1d — if i select the last 3 months' span, it should be 1mon,
|timechart span=$$ count by something. Plz help me on this.
Use timechart bins=40
to achieve your examples. It'll tell splunk to use 40 or fewer bins - 24 hours in a day, 48 half-hours, pick hours, etc.
Perfect. Thank you!
@FrankVI I have a one dashboard which consist of only one visualisation with one time picker. In timepicker if we select 2months, than in visualisation timechart span should be 1mon like that
What you describe is pretty much the standard behavior of the timechart command. Ar you running into specific situations where you would like to deviate from the automatically chosen span?
http://docs.splunk.com/Documentation/Splunk/7.2.1/SearchReference/Timechart#Default_time_spans
Hi,
on a dashboard you could try this:
https://answers.splunk.com/answers/576752/how-to-compare-time-range-picker-to-change-span-of.html