topic Re: Timechart using Subsearch to set Span in Splunk Search

Timechart using Subsearch to set Span

moogmusic — Fri, 03 Jul 2020 14:27:57 GMT

I'm trying to use a Subsearch to set the span parameter in timechart - other posts have suggested something like this:

| timechart [ stats count | addinfo | eval timerange=1593817200-1593730800
| eval span=case(timerange<=3600,"1m",timerange<=14400,"15m",timerange<=86400,"30m",timerange<=2592000,"1d",timerange>2592000,"1mon")
| return span ] sum(raw_len_gb) as GB by index cont=f

When. I run the search, I get no events matching. However if I expand the search (Ctrl+E) then it resolves to the expected value and the expanded search runs no problem.

Any ideas? Thanks

Re: Timechart using Subsearch to set Span

to4kawa — Fri, 03 Jul 2020 23:37:44 GMT

index=_internal | timechart [|makeresults | eval query="span=10m"| return $query] count

That's interesting. I think it's better to send text.

Re: Timechart using Subsearch to set Span

moogmusic — Mon, 06 Jul 2020 08:28:24 GMT

Thanks for the suggestion but I'm not quite sure what you mean?

Re: Timechart using Subsearch to set Span

moogmusic — Mon, 06 Jul 2020 08:31:12 GMT

I tried what you suggest. and get the same result - the query matches no events but then if I expand it and run the expansion, it works fine.

Re: Timechart using Subsearch to set Span

to4kawa — Mon, 06 Jul 2020 08:35:03 GMT

I think your problem is macro settings, not your question.