Timechart not showing all events with small spans

Karunamon — Tue, 03 Sep 2013 20:22:18 GMT

I've got a timechart hooked up to a particular source in my indexes, generated by a script which logs events looking like this every five minutes:

Ready,205 Not Ready,108

A field extraction has been set up on those numbers as ReadyCount and NotReadyCount respectively.

I can timechart these successfully with a string like:

host="my.internal.host" ready latest=now latest=-2d@d | timechart span=5m first(NotReadyCount) as "Not Ready", first(ReadyCount) as "Ready"

This search is connected to a dashboard graph.

My problem is, if I keep that same span and increase the time box to -7d@d, I only get a couple days worth of graph, even though the raw results show me getting all the results I'd hoped for. If I've got, say, two weeks worth of results, the larger time box will result in me getting a graph containing the first 4 days or so.

If I increase the span to 20m, I get a graph containing the last week worth of results like you'd normally expect. Unfortunately, for our purposes, we need the 5 minute resolution on the graph, so reducing the span is not a usable solution, nor is any averaging on the graph results.

How can I get all of my results to show up in the graph correctly?

Re: Timechart not showing all events with small spans

nmistry_splunk — Tue, 03 Sep 2013 23:30:19 GMT

already answered in other question jschart-truncation

topic Re: Timechart not showing all events with small spans in Splunk Search

Timechart not showing all events with small spans

Re: Timechart not showing all events with small spans