Splunk Search

Default span size change?

unclethan
Path Finder

Is it possible to adjust the default span size for a given time-range?

When using timechart the default span size works fine unless I choose "Last 7 days" , at which point the span size is 1day, meaning I have 7 data points. I would much prefer to have at least 28 datapoints (ie span=6h) to make a meaningful graph.

Where, if anywhere, can I change the default span size for "Last 7 days"?

Tags (2)
0 Karma

lguinn2
Legend

AFAIK, there is no way to change the default span. The times.conf file is where "Last 7 days" is defined - but times.conf does not specify the default span for the timechart command.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...