How do I change the timespan in a splunk timechart report?
-
31-05-2021 - |
Question
I'm building a view in splunk, and want to show a timechart. However, I would like to only show data for the last 24 hours, not the last week splunk defaults to. How do I do this?
When I'm just doing a search I can select the time span at the top of the page, but that isn't available when creating a dashboard chart.
Solution
Actually ,in Simple XML, if you use a "form" element rather than a "dashboard" element , then you can use a time range picker.
<form>
<label>My Lovely Splunk View</label>
<fieldset autoRun="true">
<input type="time" searchWhenChanged="true">
<default>Last 60 minutes</default>
</input>
</fieldset>
<row>
<chart>
<searchName>My Search</searchName>
<title>Cool Chart</title>
<option name="charting.chart">line</option>
</chart>
</row>
</form>
Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow