topic Re: Values in bar chart varying in Dashboards & Visualizations

Values in bar chart varying

Devi13 — Tue, 11 Jul 2023 14:42:27 GMT

Hello Team,

I have a bar graph representing data,

When I keep the timechart span=15m and run the search for 1h

The value for the last 15 mins is showing high and after sometime if I run the same search the value is showing normal.

Is it an expected behaviour and why is it happening like this.

How to fix this, any help is appreciated.

9:00 - 9:15 30

9:15 - 9:30 36

9:30 - 9:45 45

9:45 - 10:00 180

After sometime

9:45 - 10:00 49

Re: Values in bar chart varying

gcusello — Tue, 11 Jul 2023 14:52:17 GMT

Hi @Devi13,

could you share your search?

ciao.

Giuseppe

Re: Values in bar chart varying

Devi13 — Tue, 11 Jul 2023 14:59:13 GMT

Hello @gcusello ,

I am trying to get to know about splunk, I have a simple search,

index=abc host=abc source=abc
"xxx/*"
| timechart span=15m count by host

Re: Values in bar chart varying

gcusello — Tue, 11 Jul 2023 15:05:39 GMT

Hi @Devi13,

did you added some other filter in your search?

are the other values the same?

Ciao.

Giuseppe

Re: Values in bar chart varying

Devi13 — Tue, 11 Jul 2023 16:23:29 GMT

Hello @gcusello ,

index=* host=* OR host=* source="*" "xxxx"
| dedup AA
| timechart span=1d count by host

But when I check tomorrow, the values are going down..

Re: Values in bar chart varying

gcusello — Wed, 12 Jul 2023 06:23:12 GMT

Hi @Devi13,

what does it happen if you don't use dedup, there's the same behaviour?

ciao.

Giuseppe

Re: Values in bar chart varying

Devi13 — Wed, 12 Jul 2023 09:44:09 GMT

Hello @gcusello ,

We are good now, seems there was glitch in fetching the logs.

Thank you for your assistance.

Re: Values in bar chart varying

gcusello — Wed, 12 Jul 2023 09:45:48 GMT

Hi @Devi13 ,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉