topic Re: Timechart vs chart behaviour in Splunk Search

Timechart vs chart behaviour

ghildiya — Tue, 28 Jul 2020 11:53:34 GMT

When I run following query:

.... | bin _time span=5m | timechart avg(responseTime)

(responseTime is an extracted field)

What I understand of this query is this:

Divide timeline in a series of buckets of 5 minutes duration each, find average of responseTime for each such bucket and plot the graph(average of responsetime as Y axis, for timechart X axis is always time).

I see graph as:

So I see graph is not continuous, as there may be time slots when there is no record and hence no data point.

Now, if I change my query to:

.... | bin _time span=5m | chart avg(responseTime) by _time

My understanding is that this query should behave same as first one.

But graph I see is as:

In contrast to first graph, this one is continuous without any break.

I am not able to understand why the two queries behave differently.

Re: Timechart vs chart behaviour

richgalloway — Tue, 28 Jul 2020 12:51:31 GMT

Both commands are supposed to fill in missing values by default. Try this to see if the output is any different.

.... | timechart span=5m avg(responseTime) ``` No bin command```

You can try this to see if you get results similar to what you got from timechart.

.... | bin _time span=5m | chart cont=false avg(responseTime) by _time

Re: Timechart vs chart behaviour

ghildiya — Tue, 28 Jul 2020 13:18:33 GMT

Yes, the first query results in a continuous curve.

So , the difference between mine and yous query is that I have explicitly used

| bin _time span=5m |

..while you have used span with timchart.

Can you explain how does it make difference conceptually?

Re: Timechart vs chart behaviour

richgalloway — Tue, 28 Jul 2020 13:51:52 GMT

I wish I knew. 😉

Re: Timechart vs chart behaviour

ghildiya — Tue, 28 Jul 2020 14:19:10 GMT

Upvoted already.

Re: Timechart vs chart behaviour

L0gik2 — Wed, 02 Sep 2020 12:53:38 GMT

How can you break this out into multiple lines from here? For example I am working on a line chart of speed by vehicle across mileposts. I can do speed by vehicle or speed by milepost.

To get speed at mileposts I have used:

| chart values(speed) BY Milepost

X axis would be mileposts, Y axis is speed and then line by Vehicle_ID