topic Re: Snap-to-time in timechart in Splunk Enterprise

Snap-to-time in timechart

rsuryasaputra1 — Thu, 15 Nov 2018 00:31:33 GMT

Hello

I'm confused about this behaviour... the search works if the span is just weekly; but fails when putting w1.

| timechart span=w@w1 dc(serial)

returns with error
Streamed search execute failed because: Error in 'bin' command: The value for option span (w@w1) is invalid. When span is expressed using a sub-second unit (ds, cs, ms, us), the span value needs to be < 1 second, and 1 second must be evenly divisible by the span value.

Splunk Enterprise 6.6.3.

Thank you in advanced for your help and insights!

Re: Snap-to-time in timechart

martin_mueller — Thu, 15 Nov 2018 02:21:43 GMT

Works fine in my Splunk, but I'm on 7.2

Re: Snap-to-time in timechart

HiroshiSatoh — Thu, 15 Nov 2018 06:13:53 GMT

7.0.3 and 6.6.1 worked.

Re: Snap-to-time in timechart

echalex — Thu, 15 Nov 2018 08:42:39 GMT

The error message is misleading, in my view. I tried this in Splunk 6.5.9 and received the same error message. However, the difference is that Splunk 6.5.9 doesn't have the snap-to as a feature for timechart, but according to the doc 6.6.3, should have it.

(Original answer converted to a comment and edited entirely. I assumed that 1w@w would be the correct snap-to in 6.6.3, but I was corrected.)

Re: Snap-to-time in timechart

martin_mueller — Thu, 15 Nov 2018 12:44:08 GMT

@w1 is correct, snapping to Monday.

The integer before the time unit is optional, and documented as such by being in square brackets.

Re: Snap-to-time in timechart

martin_mueller — Thu, 15 Nov 2018 12:44:48 GMT

Do post your entire search.

Re: Snap-to-time in timechart

echalex — Thu, 15 Nov 2018 13:18:30 GMT

Right... I didn't check so far in the documentation and it's a new construct/feature to me.

Re: Snap-to-time in timechart

rsuryasaputra1 — Tue, 29 Sep 2020 22:04:39 GMT

Thanks for your responses so far. I'm querying summarised index here.

index="tv" sourcetype="stash" group="voice_analytics" source="voice_googleid_linked" | timechart span=1w dc(serial) as "# of TVs linked" <== works, last 30 days (i.e. from 20-Oct) buckets to weeks starting from Saturday.

index="tv" sourcetype="stash" group="voice_analytics" source="voice_googleid_linked" | timechart span=1w@w dc(serial) as "# of TVs linked" <== Streamed search execute failed because: Error in 'bin' command: The value for option span (1w@w) is invalid. When span is expressed using a sub-second unit (ds, cs, ms, us), the span value needs to be < 1 second, and 1 second must be evenly divisible by the span value.

index="tv" sourcetype="stash" group="voice_analytics" source="voice_googleid_linked" | timechart span=1w@w3 dc(serial) as "# of TVs linked" <== Streamed search execute failed because: Error in 'bin' command: The value for option span (1w@w3) is invalid. When span is expressed using a sub-second unit (ds, cs, ms, us), the span value needs to be < 1 second, and 1 second must be evenly divisible by the span value.

Re: Snap-to-time in timechart

martin_mueller — Mon, 19 Nov 2018 19:14:52 GMT

The searches you posted as broken are working for me. Have you considered upgrading, just in case 6.6.3 might have a bug around this feature? It was new for 6.6.