https://community.splunk.com/t5/Splunk-Search/Gap-in-chart-data/m-p/48325#M11537 <P>Hi,</P> <P>I have a chart that is produced by executing a search with a <CODE>| timechart</CODE> command.</P> <P>As the search is executing, you can see the chart cells appear as shown in the following image:<BR /> <IMG src="http://img828.imageshack.us/img828/9449/missingchartdata2.png" alt="alt text" /></P> <P>But once the search above is finished the following gap appears in the chart data:<BR /> <IMG src="http://img854.imageshack.us/img854/5166/missingchartdata1.png" alt="alt text" /></P> <P>This search has just over 150000 matching events in total. Is this gap appearing because a search limit is being exceeded? How can I stop this from happening?</P> <P>Help would be much appreciated. Thanks in advance.</P> Wed, 11 Jan 2012 12:00:05 GMT Ant1D 2012-01-11T12:00:05Z https://community.splunk.com/t5/Splunk-Search/Gap-in-chart-data/m-p/48325#M11537 <P>Hi,</P> <P>I have a chart that is produced by executing a search with a <CODE>| timechart</CODE> command.</P> <P>As the search is executing, you can see the chart cells appear as shown in the following image:<BR /> <IMG src="http://img828.imageshack.us/img828/9449/missingchartdata2.png" alt="alt text" /></P> <P>But once the search above is finished the following gap appears in the chart data:<BR /> <IMG src="http://img854.imageshack.us/img854/5166/missingchartdata1.png" alt="alt text" /></P> <P>This search has just over 150000 matching events in total. Is this gap appearing because a search limit is being exceeded? How can I stop this from happening?</P> <P>Help would be much appreciated. Thanks in advance.</P> Wed, 11 Jan 2012 12:00:05 GMT https://community.splunk.com/t5/Splunk-Search/Gap-in-chart-data/m-p/48325#M11537 Ant1D 2012-01-11T12:00:05Z https://community.splunk.com/t5/Splunk-Search/Gap-in-chart-data/m-p/48326#M11538 <P>This can be resolved by restructuring the search. Simply add a stats command stage to help the timechart command on it's way. It fixes the issue.</P> Thu, 12 Jan 2012 17:26:57 GMT https://community.splunk.com/t5/Splunk-Search/Gap-in-chart-data/m-p/48326#M11538 fox 2012-01-12T17:26:57Z https://community.splunk.com/t5/Splunk-Search/Gap-in-chart-data/m-p/48327#M11539 <P>Are you proposing using both stats and timechart?</P> <P>For example a search like this is showing gaps for me as well (but searches with smaller time windows show the data does exist and can be generated by timechart)<BR /> _some_base_search | timechart span=1d perc90(field)</P> Mon, 28 Sep 2020 15:59:45 GMT https://community.splunk.com/t5/Splunk-Search/Gap-in-chart-data/m-p/48327#M11539 sloshburch 2020-09-28T15:59:45Z