topic Re: Timechart is not behaving as expected in Dashboards & Visualizations

Timechart is not behaving as expected

m7787580 — Tue, 29 Sep 2020 12:52:04 GMT

I have inserted the csv file into the splunk starting data from "2016-11-09 00:00:00" and ending data has date "2017-02-09 06:00:00".
I tried to use
Command
| inputlookup "Thread_Count"
| eval _time= strptime('_time',"%Y-%m-%dT%H:%M:%S")
| rename Thread_Prediction as Y
| timechart span=30m avg(Y) as Y
then Starting date coming as 2016-11-09 00:00:00 and ending date coming as "2017-02-09 06:00:00" which sounds good to me as expected.

but when i try to use this command
| inputlookup "Thread_Count"
| eval _time= strptime('_time',"%Y-%m-%dT%H:%M:%S")
| rename Thread_Prediction as Y
| timechart span=60m avg(Y) as Y

By just changing the span to 60 min starting date is coming as 2016-11-08 23:30:00(which is not even present in csv) and ending date as 2017-02-09 05:30:00.
Also in my csv file there is no row as 2016-11-08 as all the data is starting from 2016-11-09.

I need my search to be like that for 30 min span i want it to end as 2017-02-09 05:30:00-->2017-02-09 06:00:00 which is coming and for 60min span it should be 2017-02-09 05:00:00 -->2017-02-09 06:00:00 and then 7 rather than 2017-02-09 05:30:00--06:30.

I am using Splunk 6.5.1 instance

Re: Timechart is not behaving as expected

somesoni2 — Wed, 15 Feb 2017 16:39:52 GMT

What is the timerange picker value you selected? When you say starting date is 2016-11-08 23:30:00, do you see that in statistics tab or visualization tab?

Re: Timechart is not behaving as expected

m7787580 — Thu, 16 Feb 2017 10:08:52 GMT

I have selected All Time and this data is static.

Re: Timechart is not behaving as expected

martin_mueller — Thu, 16 Feb 2017 10:14:54 GMT

Are you in a half-hour time zone like IST / UTC+0530?

Re: Timechart is not behaving as expected

m7787580 — Thu, 16 Feb 2017 10:17:29 GMT

Yes i am in IST zone

Re: Timechart is not behaving as expected

martin_mueller — Thu, 16 Feb 2017 10:23:46 GMT

For half-hour time zones, timechart seems to snap to :30 minute mark instead of :00 minute mark. Not sure if that's a bug or a feature 😄 feel free to poke support for that.

You see 2016-11-08 23:30:00 because data at 2016-11-09 00:00:00 falls within the hour from 2016-11-08 23:30:00 to 2016-11-09 00:30:00.