DEV Community

Maxime Guilbert
Maxime Guilbert

Posted on • Edited on

3 3

Tips about Splunk Timecharts

In some requests or in some dashboards, you want to have a timechart to visualize (for example) how much calls you receive for an operation.

So here are 2 tips which can help you to work with!


Span

By default, the timechart will group the data with a span depending of the time period you choose. But maybe you want to fix this span a particular value.
So here is the parameter

timechart span=[time] ...
Where time is a number associated with a letter to define the time span.

Letters available

  • s - second
  • m - minute
  • h - hour
  • d - day
  • w - week

Examples

# 1 hour span
index=application_a | timechart span=1h count by name

# 10 seconds span
index=application_b | timechart span=10s count by title
Enter fullscreen mode Exit fullscreen mode

Thing to avoid

When you are using the timechart, avoid to have a "sort" in it. It won't be useful and it can alter your result.

In a larger way, be sure to remove all the treatments which are not useful for your request. It will take more time for your request to be executed and as said, you can retrieve a false result.


I hope it will help you! 🍺

Hostinger image

Get n8n VPS hosting 3x cheaper than a cloud solution

Get fast, easy, secure n8n VPS hosting from $4.99/mo at Hostinger. Automate any workflow using a pre-installed n8n application and no-code customization.

Start now

Top comments (0)

Billboard image

The Next Generation Developer Platform

Coherence is the first Platform-as-a-Service you can control. Unlike "black-box" platforms that are opinionated about the infra you can deploy, Coherence is powered by CNC, the open-source IaC framework, which offers limitless customization.

Learn more

👋 Kindness is contagious

Please leave a ❤️ or a friendly comment on this post if you found it helpful!

Okay