topic Re: scatter chart is not working. in Dashboards & Visualizations

scatter chart is not working.

Anantha123 — Thu, 05 Sep 2019 15:55:42 GMT

Hi,

I am running a query to show in scatter chart with name-field, X-axis and Y-axis . This Query throws over 15000 results for past 24 hrs . Since the limit of scatter chart is 10000 , I gave limit=5000 to try . When I am running the query for 60 mins ,I get the scatter chart as expected . But when I run same query for 24 hrs ( the record may be high but I have the limit added in query ) , It is breaking the search by saying "script long running - stop script" . Please advice

Re: scatter chart is not working.

DalJeanis — Thu, 05 Sep 2019 17:42:08 GMT

Sounds like your search needs to be tuned. If you post the code, we can suggest ways to make it run more effectively.

Re: scatter chart is not working.

Anantha123 — Wed, 30 Sep 2020 02:05:08 GMT

Re: scatter chart is not working.

DalJeanis — Fri, 06 Sep 2019 21:02:37 GMT

Okay, here's the way to connect all the dots at one time more efficiently. This method is called the "Splunk Stew" method, and uses stats to join on the key instead of join.

index="123Prod" source="/var/ABC/CDE/trace.log" 
   (StartAuthenticationSession) OR
   (responseType=AuthenticationSucceeded sessionCompleted)
| rex field=_raw "traceId=\"(?[^:]+)"
| eval OutTime=case(responseType="AuthenticationSucceeded",_time)
| eval InTime=case(isnull(OutTime),_time)
| stats min(InTime) as InTime max(OutTime) as OutTime by TraceID

Then, given those results, you can cull them to only 5K with

| sort 5000 InTime

See how that works for you.

The "Splunk Stew" method is more fully described here - https://answers.splunk.com/answers/524250/how-to-search-for-matches-in-two-different-searche.html