As many have already voted, plus Enterprise updated reference
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart
More specifically #Span_options
"timespan" does not exist and "Timescale unit[s]" is required.
Timechart requires the argument `span`, not `timespan`. As well, you must specify the unit of time (example 3h or 5m) with this argument so the only option is `span=12h`.
https://docs.splunk.com/Documentation/SCS/current/SearchReference/TimechartCommandExamples
https://docs.splunk.com/Documentation/Splunk/9.0.4/SearchReference
I guess he sent a wrong one to you. But the result should be “span =12h”. The syntax of bin options should be [span=<log-span>|span=<span-length>|span=<snap-to-time>]. And congratulations you passed the examination.
https://docs.splunk.com/Documentation/Splunk/9.0.4/SearchReference/Timechart#Span_options/Timechart#Span_options
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
SCARODJ
10 months, 3 weeks agoDree_Dogg
1 year, 5 months agoasarali
1 year, 7 months agoHarrysa
1 year, 9 months agoJayce1
1 year, 11 months agofoxx99
2 years agoSolventCourseisSCAM
2 years agoyaman778
1 year, 10 months agoSolventCourseisSCAM
2 years agoyukilee
1 year, 11 months ago