topic Re: strange timechart effect in Getting Data In

strange timechart effect

alexeysharkov — Tue, 25 Feb 2025 10:28:40 GMT

Hello

I have xml messages in search. row like this

<log><local_time>2025-02-25T15:02:59:955059+05:00</local_time><bik>ATYNKZKA</bik><fileName>stmt_3110449968.pdf</fileName><size>555468</size><iin>800716350670</iin><agrementNumber>3110449968</agrementNumber><agrementDate>08.11.2011</agrementDate><referenceId>HKBRZA0000388473</referenceId><bankCode>ALTYNDBZ</bankCode><result>OK</result></log>

<log><local_time>2025-02-25T15:02:59:885557+05:00</local_time><bik>ATYNKZKA</bik><fileName>stmt_dbz.pdf</fileName><size>152868</size><iin>840625302683</iin><agrementNumber>4301961740</agrementNumber><agrementDate>21.06.2023</agrementDate><referenceId>HKBRZA0000388476</referenceId><bankCode>ALTYNDBZ</bankCode><result>OK</result></log>

I see after search in field in '_time' and 'log.local_time' date time with seconds and parts. Seems to be OK

But when i try build timechart i see next

Seems to be timechart don't know about minutes and seconds. And know only hours. My span=5m is ignored.

For me it is ok using _time or log.local_time

I try various method parse with strptime but useless

thanks

Re: strange timechart effect

gcusello — Tue, 25 Feb 2025 10:33:53 GMT

Hi @alexeysharkov ,

i found a similar behavior that changed putting span after the command:

| timechart span=5m count BY log.bankCode

Ciao.

Giuseppe

Re: strange timechart effect

alexeysharkov — Tue, 25 Feb 2025 11:11:16 GMT

Hi Giuseppe

yeap , now span divide timeline correctly but count incorrect. Only at hour i see count

Re: strange timechart effect

gcusello — Tue, 25 Feb 2025 11:50:55 GMT

Hi @alexeysharkov ,

don't use the table command before timechart and please share some raw data.

Ciao.

Giuseppe

Re: strange timechart effect

alexeysharkov — Tue, 25 Feb 2025 12:24:56 GMT

change search without table - useless

Raw data in first message. Just simple XML source

<log><local_time>2025-02-25T17:02:59:979253+05:00</local_time><bik>TSESKZKA</bik><fileName>stmt_4102880506.pdf</fileName><size>238529</size><iin>780515303362</iin><agrementNumber>4102880506</agrementNumber><agrementDate>08.09.2021</agrementDate><referenceId>HKBRZA0000388353</referenceId><bankCode>Jysan bank</bankCode><result>OK</result></log>

<log><local_time>2025-02-25T17:02:59:986891+05:00</local_time><bik>INLMKZKA</bik><fileName>stmt_dbz.pdf</fileName><size>195992</size><iin>710416303014</iin><agrementNumber>4400863944</agrementNumber><agrementDate>17.02.2024</agrementDate><referenceId>HKBRZA0000388352</referenceId><bankCode>Halyk bank</bankCode><result>OK</result></log>

Re: strange timechart effect

gcusello — Tue, 25 Feb 2025 12:47:51 GMT

Hi @alexeysharkov ,

I suppose that _time corresponds to the <local_time>.

please another stupid try: rename log.bankCode in log_bankCode before timecharting and then use this field in the timechart.

could you share your events, with also the _time field?

Ciao.

Giuseppe

Re: strange timechart effect

ITWhisperer — Tue, 25 Feb 2025 13:07:37 GMT

Can you share some events which are not in the count?

Re: strange timechart effect

alexeysharkov — Wed, 26 Feb 2025 08:41:01 GMT

@ITWhisperer

Hello i think all messages counted by count . But spreading is incorrect.

I 've expected count spread on every 5 min (span=5m) but it count spread every hour

I see time in ROW like this

I have search with another sourcetype. _time format is the same/

And similar timechart is OK spreading with span =5 min work OK

Dontknoooooww 😞

Re: strange timechart effect

ITWhisperer — Wed, 26 Feb 2025 09:23:01 GMT

Are you saying that this event 13:02:59 is not counted? Or it is counted in the 13:00:00 - 13:04:59 bin?

You haven't shown an event which is in the wrong time bucket yet!

Re: strange timechart effect

alexeysharkov — Wed, 26 Feb 2025 09:47:59 GMT

Ok i get find only one xml event

search it index=hcg_app_damu_prod sourcetype=damu_log_dbz_out earliest=-1d | spath | search (log.referenceId=HKBRZA0000389094 AND log.agrementNumber=4303291972)

And then i build timechart

So event with _time =2025-02-26T14:02:59.970+05:00

Goes to bucket at 2025-02-26 14:00:00

Im sure my events spread on 5 minutes buckets

I have no Idea why it go to hour bucket's

Re: strange timechart effect

ITWhisperer — Wed, 26 Feb 2025 09:51:52 GMT

Again, this event appears to be in the right bucket. Please provide evidence that you have events in the wrong buckets, otherwise, this seems to be a non-problem 😎

Re: strange timechart effect

alexeysharkov — Wed, 26 Feb 2025 11:00:09 GMT

@ITWhisperer @gcusello

My vendor is perfect

hi write

select
to_char(systimestamp,'YYYY-MM-DD"T"HH24:MM:SS:FFTZH:TZM') now_time from blabla

and use it to save log xml

instead

to_char(systimestamp,'YYYY-MM-DD"T"HH24:MI:SS:FFTZH:TZM') now_time

so date is incorrect

I coming to rewrite it

SORRY

Re: strange timechart effect

gcusello — Wed, 26 Feb 2025 13:33:20 GMT

Hi @alexeysharkov ,

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉