topic Re: Time range not changing in Pivot interface in Reporting

Time range not changing in Pivot interface

wpreston — Mon, 14 Oct 2013 15:09:14 GMT

When I or one of my users changes the time range in Pivot, the change doesn't take effect. For instance, when we change the filter for time to the last 24 hours on the "New Pivot" screen to "Last 24 hours", Splunk runs the search job then returns a count for all events from 12/31/69 6:00:00.000 PM to now.

This only appears to happen on Pivots we create; when I change the date range the sample Pivots provided with the installation of Splunk 6, they work just fine. My suspicion is that it's a permissions issue, but I'm just not sure. My account has admin privileges, and has permission to read and write on the data model/pivot.

Re: Time range not changing in Pivot interface

Simon_Fishel — Mon, 14 Oct 2013 18:29:13 GMT

What is the data source for your Data Model? Is the object you're pivoting on Event-based or Transaction-based? And have you accelerated the Data Model?

Re: Time range not changing in Pivot interface

wpreston — Mon, 14 Oct 2013 19:04:03 GMT

Thanks for your response, here are my answers to your questions:

Data source: It is an application event log for an access control system. This is not one of Splunk’s predefined sourcetypes, I had to define it myself via props.conf and transforms.conf. Splunk does, however, recognize the timestamp in each event.

Event or Transaction based?: These are Event based logs.

Acceleration?: I’ve tried it both ways, and neither appears to help. The Acceleration job does complete successfully.

Here’s an example of the date from one of the events:

31-Dec-2012 23:34:02, Rest, of, event…

Re: Time range not changing in Pivot interface

Simon_Fishel — Mon, 14 Oct 2013 23:47:39 GMT

Interesting, I'm not able to reproduce the issue on my own, either with a sample data model or one I created myself. So it sounds like it's specific either to your data set or the way your data model is configured.

Would you be willing to attach some of your configuration files so I can try out your data model on my system? I think I would need:

some sample data
props.conf
transforms.conf
the data model .json file (which should be in <splunk root>/etc/apps/<your app>/local/data/models)

Re: Time range not changing in Pivot interface

wpreston — Thu, 17 Oct 2013 23:14:54 GMT

Sorry for my long response time. Unfortunately this will not be possible, the data and the transforms for it are very sensitive. Thank you for the offer, though!

Re: Time range not changing in Pivot interface

sowings — Fri, 18 Oct 2013 00:25:02 GMT

Is the _time field included in the list of required fields for your data model?

Re: Time range not changing in Pivot interface

wpreston — Fri, 18 Oct 2013 16:40:56 GMT

Yes, the _time field is included, and time is the first of the filter options on the pivot.

Re: Time range not changing in Pivot interface

bruceclarke — Thu, 24 Oct 2013 18:18:11 GMT

Was this resolved? I am running into the same issue with my Pivot data model. It's really frustrating, since it has to re-run the search each time you change something in the Pivot, which takes a few minutes.

Re: Time range not changing in Pivot interface

Simon_Fishel — Thu, 24 Oct 2013 18:41:34 GMT

@bruceclarke, we haven't been able to reproduce the issue internally yet. If you don't mind providing the info I requested from the original poster, it would help a lot.

Re: Time range not changing in Pivot interface

helge — Tue, 29 Oct 2013 19:51:31 GMT

I have this, too, on a data model I built for my app.

Re: Time range not changing in Pivot interface

martin_mueller — Thu, 31 Oct 2013 12:46:20 GMT

I'm seeing this happening with the sample data models for _internal and _audit. No matter what time range I select, the pivot results are calculated over all time.

Re: Time range not changing in Pivot interface

martin_mueller — Thu, 31 Oct 2013 12:53:31 GMT

Here's a screenshot of what I see:

I've opened the searches object in the _audit model, and am charting the average of result_count over time for the last 60 minutes. At the top of the page you can see it's actually running over all time, and the timechart is complaining about too many spans - probably it's trying to apply the 60-minute-range buckets of one minute to all time.

This happens regardless of what I do in the pivot interface.
Clicking "open in search" uses the correct time range in the search page.

Re: Time range not changing in Pivot interface

Simon_Fishel — Thu, 31 Oct 2013 17:56:26 GMT

@martin_mueller, I downloaded a fresh version of Splunk 6 and tried to recreate your screenshot (including using the "de-DE" locale). For me, the time range was handled correctly. Do you have any customizations around search time ranges on your system?

Re: Time range not changing in Pivot interface

martin_mueller — Thu, 31 Oct 2013 18:02:56 GMT

I'll check that when I'm back in the office tomorrow. It's been installed over a previous 5.0.1 install I've been using for a year, so there may be all kinds of .conf settings I've forgotten about 🙂 No setting should cause this, but maybe we'll find a way to reproduce like this. It has to be caused by some coincidence, in general the feature is working fine for others.

Re: Time range not changing in Pivot interface

Simon_Fishel — Thu, 31 Oct 2013 18:23:56 GMT

Agreed, there is most likely a bug in the pivot interface that's causing this. Hopefully we can track down the root cause so we can provide you with a workaround until we figure out a proper fix from our end.

Re: Time range not changing in Pivot interface

martin_mueller — Fri, 01 Nov 2013 08:25:53 GMT

There are no times.conf files in .../local. I can create a diag if you like, there's loads of old stuff still flying around in various apps.

Re: Time range not changing in Pivot interface

martin_mueller — Fri, 01 Nov 2013 13:27:28 GMT

Getting colleagues to test this, there may be a pattern emerging. Either the bug is related to running the server on Windows, or to installing over an existing Splunk 5... or both, not enough feedback yet.

Simon, what OS were you using to replicate? I've got three different machines with Windows 7, 64bit, Splunk 6.0, each installed over 5.0.x that show the same buggy behaviour, so I doubt it's due to individual configuration.

Re: Time range not changing in Pivot interface

Simon_Fishel — Fri, 01 Nov 2013 15:16:53 GMT

Very interesting. I was using a Linux box to replicate, so I'll give it another try matching your scenario.

Re: Time range not changing in Pivot interface

Simon_Fishel — Fri, 01 Nov 2013 16:26:56 GMT

It appears to just be a Windows issue. I installed Splunk 6 on a Windows 7, 32bit system and I now see the buggy behavior. Working on tracking down the root cause now...

Re: Time range not changing in Pivot interface

Simon_Fishel — Fri, 01 Nov 2013 17:29:43 GMT

Well the good news is that I figured out what's going wrong and filed an internal issue, but unfortunately I haven't been able to figure out a good workaround for you.

As long as your data model is not accelerated, the time range should work correctly in the search page, dashboards, and the report viewing page.

Do you have an existing support case? If so let me know and I will link it to the internal issue I created.