topic Re: Passing span as argument to timechart in Splunk Search

Passing span as argument to timechart

keerthana_k — Mon, 18 Mar 2013 12:52:48 GMT

Hi
I have a requirement wherein I have to display 3 different series in a single chart. I am using an append query to fetch all the results and manipulating the search job in my dashboard.xml. I also have a dropdown at the top to select time ranges. Based on the time ranges selected, my timechart's span should also vary ex. for last 60 minutes, the span should be 5 minutes and so on. When I pass the span value dynamically, I am getting an error saying "Invalid Option". Please tell me how this can be done.

Re: Passing span as argument to timechart

martin_mueller — Mon, 18 Mar 2013 13:02:02 GMT

How are you passing the span now?

Have you considered specifying a fixed maximum number of bins instead?

Re: Passing span as argument to timechart

keerthana_k — Tue, 19 Mar 2013 08:43:08 GMT

I have hard coded it for now. I cannot use fixed bins as my time ranges vary greatly. They are Last 60 minutes, Last 24 hours and Last 7 days.

Re: Passing span as argument to timechart

martin_mueller — Tue, 19 Mar 2013 22:34:47 GMT

In that case you can hack yourself to dynamic spans like this:

index=_internal | timechart count [stats count | addinfo | eval range = info_max_time - info_min_time | eval span = "span=".case(range < 4000, "5m", range < 90000, "1h", 1=1, "12h") | return $span]

The subsearch probably is best put into a macro.

Re: Passing span as argument to timechart

keerthana_k — Mon, 25 Mar 2013 09:42:27 GMT

I tried this but I keep getting the error: SearchException: This search cannot be parsed when parse_only is set to true. Any help with this?

Re: Passing span as argument to timechart

helge — Mon, 19 Jan 2015 23:52:06 GMT

Works great!