https://community.splunk.com/t5/Splunk-Search/Real-time-window-not-working-with-timechart/m-p/403963#M174399 <P>You actually do have severe timestamping problems. I suggest that you install the <CODE>Meta Woot!</CODE> (<A href="https://splunkbase.splunk.com/app/2949/">https://splunkbase.splunk.com/app/2949/</A>) and <CODE>Data Curator</CODE> (<A href="https://splunkbase.splunk.com/app/1848/">https://splunkbase.splunk.com/app/1848/</A>) apps and go through the screens and fix your timestamping problems. You can hear a bit more about why these are important in my .conf talk here:</P> <P><A href="https://conf.splunk.com/files/2018/recordings/10-must-have-apps-fn1072.mp4">https://conf.splunk.com/files/2018/recordings/10-must-have-apps-fn1072.mp4</A></P> Tue, 27 Nov 2018 06:20:28 GMT woodcock 2018-11-27T06:20:28Z https://community.splunk.com/t5/Splunk-Search/Real-time-window-not-working-with-timechart/m-p/403960#M174396 <P>| eval _time=_time+28800 |timechart values(Acc_X_G) as Acc_X values(Acc_Y_G) as Acc_Y values(Acc_Z_G) as Acc_Z</P> <P>Above is my search code for my timechart. I have set the Auto Refresh Delay to 1s. <BR /> However, the timechart only works with All time(real-time) but it fails with the other real time windows. (30s, 1min, 5min, 30min &amp; 1hr)<BR /> Also, my data has been time stamped correctly.</P> <P>Any idea what's the problem here?</P> Tue, 29 Sep 2020 22:08:03 GMT https://community.splunk.com/t5/Splunk-Search/Real-time-window-not-working-with-timechart/m-p/403960#M174396 marvinlee93 2020-09-29T22:08:03Z https://community.splunk.com/t5/Splunk-Search/Real-time-window-not-working-with-timechart/m-p/403961#M174397 <P>If your time is timestamped correctly, then you would not need to do <CODE>| eval _time = _time+28800</CODE>.</P> Tue, 27 Nov 2018 03:09:46 GMT https://community.splunk.com/t5/Splunk-Search/Real-time-window-not-working-with-timechart/m-p/403961#M174397 woodcock 2018-11-27T03:09:46Z https://community.splunk.com/t5/Splunk-Search/Real-time-window-not-working-with-timechart/m-p/403962#M174398 <P>Hi! Thanks for the quick reply! I have added this line because the x-axis(time) on my timechart is lagging by 8 hours. Didn't know that it will affect my real-time search! Is there a way to solve this issue without affecting my real time search window?</P> Tue, 27 Nov 2018 04:01:56 GMT https://community.splunk.com/t5/Splunk-Search/Real-time-window-not-working-with-timechart/m-p/403962#M174398 marvinlee93 2018-11-27T04:01:56Z https://community.splunk.com/t5/Splunk-Search/Real-time-window-not-working-with-timechart/m-p/403963#M174399 <P>You actually do have severe timestamping problems. I suggest that you install the <CODE>Meta Woot!</CODE> (<A href="https://splunkbase.splunk.com/app/2949/">https://splunkbase.splunk.com/app/2949/</A>) and <CODE>Data Curator</CODE> (<A href="https://splunkbase.splunk.com/app/1848/">https://splunkbase.splunk.com/app/1848/</A>) apps and go through the screens and fix your timestamping problems. You can hear a bit more about why these are important in my .conf talk here:</P> <P><A href="https://conf.splunk.com/files/2018/recordings/10-must-have-apps-fn1072.mp4">https://conf.splunk.com/files/2018/recordings/10-must-have-apps-fn1072.mp4</A></P> Tue, 27 Nov 2018 06:20:28 GMT https://community.splunk.com/t5/Splunk-Search/Real-time-window-not-working-with-timechart/m-p/403963#M174399 woodcock 2018-11-27T06:20:28Z