topic Using the bucket command, why doesn't one bucket range appear? in Deployment Architecture

Using the bucket command, why doesn't one bucket range appear?

rana_nour — Mon, 13 Jul 2015 12:46:24 GMT

I have a search that categorizes results according to the response time and buckets them in 1000. I have 0-1000 and 1000-2000 and 3000-4000 and so on. It appears perfectly, but I never have 2000-3000 appear any help?

index=gasf  host="*hub-vpn*" uri_path="*default.aspx" referer!="*SSOLogon*"  | rex "(?<response_time>\d+)\s[\-\+]$" | eval resTimeInMS=round((response_time/1000),2) | bucket resTimeInMS span=1000   | timechart span=15m c by resTimeInMS usenull=f

Re: Using the bucket command, why doesn't one bucket range appear?

otman01 — Mon, 13 Jul 2015 13:01:17 GMT

its probabely to not get all captions, but do you have some data presented in this graphe for this interval right?

Re: Using the bucket command, why doesn't one bucket range appear?

jeffland — Mon, 13 Jul 2015 13:31:10 GMT

If you leave the bucket out of your search, is there data in that range?

Re: Using the bucket command, why doesn't one bucket range appear?

woodcock — Mon, 13 Jul 2015 14:34:40 GMT

It does not appear because you have no values. The fillnull directive applies to the axes, not to the number of lines in the chart. Your 'by' field is resTimeInMS so the lines plotted will be only those for which this field has values. Think about it: if you were plotting by host how would you expect timechart to "fill in gaps" in host values? The only way to solve this is to use append to force each range value to have an entry by appending exactly 1 event in each 15-minute span and then subtracting one from each before you plot it. I will have the implementation of this solution as an exercise for the OP.