makecontinuous
Contents
makecontinuous
Synopsis
Makes a field that is supposed to be the x-axis continuous (invoked by chart/timechart).
Syntax
makecontinuous [<field>] <bucketing-option>*
Required arguments
- <bucketing-option>
- Datatype: bins | span | start-end
- Description: Discretization options. See "Bucketing options" for details.
Optional arguments
- <field>
- Datatype: <field>
- Description: Specify a field name.
Bucketing options
- bins
- Syntax: bins=<int>
- Description: Sets the maximum number of bins to discretize into.
- span
- Syntax: <log-span> | <span-length>
- Description: Sets the size of each bucket, using a span length based on time or log-based span.
- <start-end>
- Syntax: end=<num> | start=<num>
- Description:Sets the minimum and maximum extents for numerical buckets. Data outside of the [start, end] range is discarded.
Log span syntax
- <log-span>
- Syntax: [<num>]log[<num>]
- Description: Sets to log-based span. The first number is a coefficient. The second number is the base. If the first number is supplied, it must be a real number >= 1.0 and < base. Base, if supplied, must be real number > 1.0 (strictly greater than 1).
Span length syntax
- span-length
- Syntax: <span>[<timescale>]
- Description: A span length based on time.
- <span>
- Syntax: <int>
- Description: The span of each bin. If using a timescale, this is used as a time range. If not, this is an absolute bucket "length."
- <timescale>
- Syntax: <sec> | <min> | <hr> | <day> | <month> | <subseconds>
- Description: Time scale units.
- <sec>
- Syntax: s | sec | secs | second | seconds
- Description: Time scale in seconds.
- <min>
- Syntax: m | min | mins | minute | minutes
- Description: Time scale in minutes.
- <hr>
- Syntax: h | hr | hrs | hour | hours
- Description: Time scale in hours.
- <day>
- Syntax: d | day | days
- Description: Time scale in days.
- <month>
- Syntax: mon | month | months
- Description: Time scale in months.
- <subseconds>
- Syntax: us | ms | cs | ds
- Description: Time scale in microseconds (us), milliseconds (ms), centiseconds (cs), or deciseconds (ds).
Description
Examples
Example 1: Make "_time" continuous with a span of 10 minutes.
... | makecontinuous _time span=10mSee also
Answers
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the makecontinuous command.
This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 View the Article History for its revisions.