topic Re: Single with timechart display issue in Dashboards & Visualizations

Single with timechart display issue

Chris_Semon — Tue, 02 Apr 2024 17:50:47 GMT

I have a query that counts totals for each day for the past 7 days and produces these results: 2, 0, 2, 0, 0, 0, 0. No matter what I do, the SINGLE with timechart and trendlines enabled produced ignores the trailing zeros and displays a 2, with a trendling of increasing 2. It should diplay a zero with a zero trend line representing the last two segments (both zero).

Before the main query (as recommended) I have used the | makeresults earliest"-7d@d" count =0 to ensure the days with zero count are included. I have tried the suggested appendpipe option:

and the appendpipe with max(count) option:

Neither create the correct timechart.

From the dashboard in the Edit UI mode, if I click on the query magnifying glass and open in a new tab, the results do NOT diplay the trailing zeros.

If I copy and paste the query into a search bar with the time picker set to All Time, I get the correct values: 2, 0, 2, 0, 0, 0, 0. Is there an option setting I may have wrong? How do I fix this?

Re: Single with timechart display issue

marnall — Tue, 02 Apr 2024 20:28:09 GMT

I don't fully understand what you mean... would it be possible to include screenshots demonstrating the timechart you would like (using the All-time search) versus what you get? Also a full query (without private information) would be very helpful.

E.g. something like this?

Re: Single with timechart display issue

bowesmana — Tue, 02 Apr 2024 23:12:12 GMT

Can you give a bit more about your query because having to use appendpipe to get dates filled in seems a little unusual. This example

will produce this single viz whether or not you add

| timechart span=1d max(count) as count

Re: Single with timechart display issue

Chris_Semon — Wed, 03 Apr 2024 14:30:34 GMT

Thank you for your help, but I figured out what was wrong. The query I am using pulls data from a relational database. We have created a macro that converts the SPL into the query language for that DB and part of that includes the time frame. So essentially, for those queries the time picker is irrelevant. As I stated previously, the query works fine in the splunk search bar. However, in the dashboard, the query is the PARENT Query, and the results are filtered by subsequent child queries. The child queries have no concept of the earliest or latest, even though they are supposed to inherit that from the parent query, and the SPL doesn't allow you to put that code in after the filter query. Our problem was that since the Parent Query didn't use the earliest and latest times, we deleted the code that defined that after the query. Once I reinserted the code for the earliest and latest times after the Parent Query, the Single with trend lines worked as they should.