I have a working chart that uses "timechart span=1w". Is there any way to make the week span go from Monday-Sunday rather than Sunday-Saturday.
Is there a way to modify the default range of span=1w?
I don't think you can modify the default range. Have you tried something like this? I went back 2 weeks ago...you can modify it of course, and change the span to 7d instead of 1w.
... earliest=-2w@w1 latest=-1w@w0 | timechart span=7d ...
I don't think you can modify the default range. Have you tried something like this? I went back 2 weeks ago...you can modify it of course, and change the span to 7d instead of 1w.
... earliest=-2w@w1 latest=-1w@w0 | timechart span=7d ...
Hi,
thanks, I tried it out again and now it works for the defined timespan. Is it possible to configure this to run over the whole timespan of the dataset automatically? So that every date is included?
Best
Heinz
Yes, earliest is not a command and can't be right after the pipe typically. You can still use earliest but it's going to be used before your first '|' like this:
sourcetype=mysourcetype NOT fail* earliest=-2w@w1 latest=-1w@w0 | timechart...
Sounds like you have
You could add
Hi,
is this still possible in the current Splunk Version? Adding this "... earliest=-2w@w1 latest=-1w@w0" doesn't work for me. It tells me "Unknown search command 'earliest'"
Thanks in advance
Heinz
That worked perfectly