Why is base search only showing several hours of events instead of 24 hours?

Snigdha95 — Thu, 12 Dec 2019 13:22:09 GMT

I have a dashboard where I have used base search in each panel. Within the dashboard, I have 40 different panels and in all the panel I have used timechart count by the severity field.

  <panel>
  <event>
    <title>BASE SEARCH PANEL</title>
    <search id="id">
      <query>index="abc" sourcetype=xyz </query>
      <earliest>$Time_token.earliest$</earliest>
      <latest>$Time_token.latest$</latest>
    </search>
    <option name="count">1</option>
    <option name="list.drilldown">none</option>
  </event>
</panel>

<row>
<panel>
  <title>ABC</title>
  <chart>
    <search base="id">
      <query>search "my search query| timechart values(field)"</query>
    </search>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">-90</option>
    <option name="charting.axisLabelsY.majorUnit">1</option>
    <option name="charting.axisTitleX.visibility">collapsed</option>
    <option name="charting.axisTitleY.text">Good (1)</option>
    <option name="charting.axisY.maximumNumber">1</option>
    <option name="charting.axisY.minimumNumber">0</option>
    <option name="charting.chart">line</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">1</option>
    <option name="charting.legend.placement">top</option>
    <option name="charting.lineWidth">2</option>
    <option name="charting.seriesColors">[430DEB,ED7212]</option>
    <option name="height">317</option>
    <option name="refresh.display">progressbar</option>
    <option name="trellis.enabled">0</option>
    <option name="trellis.scales.shared">1</option>
    <option name="trellis.size">medium</option>
  </chart>
</panel>
<panel>
  <title>XYZ</title>
  <chart>
    <search base="id">
      <query>search "my search query| timechart values(field)"</query>
    </search>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">-90</option>
    <option name="charting.axisLabelsY.majorUnit">1</option>
    <option name="charting.axisTitleX.visibility">collapsed</option>
    <option name="charting.axisTitleY.text">Good (1)</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.abbreviation">none</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.abbreviation">none</option>
    <option name="charting.axisY.maximumNumber">1</option>
    <option name="charting.axisY.minimumNumber">0</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.abbreviation">none</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">line</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.showDataLabels">none</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">1</option>
    <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.mode">standard</option>
    <option name="charting.legend.placement">top</option>
    <option name="charting.lineWidth">2</option>
    <option name="charting.seriesColors">[430DEB,ED7212]</option>
    <option name="height">274</option>
    <option name="refresh.display">progressbar</option>
    <option name="trellis.enabled">0</option>
    <option name="trellis.scales.shared">1</option>
    <option name="trellis.size">medium</option>
  </chart>
</panel>

My problem is that currently, whenever I ran this dashboard, the timechart only displays results for the last 3-4 hours (Not the entire 24 hour frame) whereas I have results for 24hours. When I search from the panel, I could see the statistics result showing 24 hour details, which means my search query is fine.

Based on the code shown above and my base search, what am I doing wrong? Is there something wrong with my code/logic?

I appreciate any comments/guidance/hints.

Thanks.

Re: Why is base search only showing several hours of events instead of 24 hours?

BainM — Thu, 12 Dec 2019 19:23:43 GMT

Hi Snigdha95-
I am pretty sure your
option name="count"-1-option

is affecting it in some manner.

Check out this Answers Link:
https://answers.splunk.com/answers/188992/how-to-dynamically-change-number-of-rows-displayed.html

Re: Why is base search only showing several hours of events instead of 24 hours?

seemanshu — Mon, 16 Dec 2019 09:12:32 GMT

Hi Snigdha95,
The count option is in some how affecting the results. You should first check all the results without applying the limit on the count of results.
Hopefully, that would help!

topic Re: Why is base search only showing several hours of events instead of 24 hours? in Splunk Search

Why is base search only showing several hours of events instead of 24 hours?

Re: Why is base search only showing several hours of events instead of 24 hours?

Re: Why is base search only showing several hours of events instead of 24 hours?