topic Re: Realtime graph time axis in Dashboards & Visualizations

Realtime graph time axis

vbumgarner — Fri, 06 May 2011 20:34:55 GMT

Is there any way to tell a realtime graph to always show the last hour, even if there is only data for a small part of that time?

To make things more interesting, this is a FlashChart in a PostProcess in an advanced xml dashboard, so fixedrange doesn't work.

Re: Realtime graph time axis

sideview — Mon, 28 Sep 2020 09:32:20 GMT

UPDATE:

Indeed the earliest/latest bounds of the search appear to not survive the freezing process. So when the postProcess timechart gets to it, it implicitly snaps in around the actual data.

Here's one weird thing you might try. It adds 2 extra phantom events into any search. One whose _time value is the info_min_time, one whose _time is the info_max_time. If you add this to your base search theoretically it'll force the postProcess to keep the original bounds.

PREVIOUS ANSWER:

I assume you're not using timechart? Because timechart will always leave empty leading and trailing buckets, even when there's postProcess involved. So either you're doing stats foo by _time manually or there must be something else going on.

Can you paste in the search you're using?

Re: Realtime graph time axis

vbumgarner — Sat, 07 May 2011 00:07:53 GMT

Search module with a search of foo, earliest of rt-1h, latest of rt.
PostProcess module with a search of |timechart span=1m count by bar.

If I run the full query in Advanced Charting, it works as expected.

Re: Realtime graph time axis

sideview — Sat, 07 May 2011 00:35:20 GMT

That doesnt seem right. At least when you split this up into a base search and a postprocess search, Splunk wont extract the 'bar' term cause it doesnt know anyone cares about 'bar'. maybe this is an oversimplified example?

Re: Realtime graph time axis

vbumgarner — Sat, 07 May 2011 00:42:30 GMT

This is indeed an oversimplified example. bar is referenced in the initial query, so it does work. The only problem is that the timechart has a timeline exactly scaled to the events seen, not the last hour.