topic Timechart results in to week buckets - keeps forcing monthly in Splunk Search

Timechart results in to week buckets - keeps forcing monthly

999chris — Thu, 16 Mar 2017 11:29:32 GMT

Splunk can be pretty mean at times and do things that have no sense. Im trying to create a chart that shows a few percentages from data going back 6 months which is plopped in to week buckets. The below query is only creating monthly buckets though...

index=pmc sourcetype=stash source="PDL Per*" WORKFLOWSTATUSID!=1 earliest=-6mon@w
| eval WORKFLOWSTATUSID=case(WORKFLOWSTATUSID==0,"Finished", WORKFLOWSTATUSID==1, "In Progress", WORKFLOWSTATUSID==4, "Error",WORKFLOWSTATUSID==7,"Failed", 1=1, "Other") 
| bin _time span=7d
| timechart mean(percent) as percent by WORKFLOWSTATUSID usenull=f span=7d

All help is appreciated greatly.

Re: Timechart results in to week buckets - keeps forcing monthly

999chris — Thu, 16 Mar 2017 11:39:06 GMT

Here is an image of the results:

Re: Timechart results in to week buckets - keeps forcing monthly

jkat54 — Thu, 16 Mar 2017 11:47:39 GMT

What happens if you change 7d to 1w?

Re: Timechart results in to week buckets - keeps forcing monthly

cmerriman — Thu, 16 Mar 2017 12:10:19 GMT

can you either remove the bin _time or make the timechart into a chart and see if that works?

index=pmc sourcetype=stash source="PDL Per*" WORKFLOWSTATUSID!=1 earliest=-6mon@w
 | eval WORKFLOWSTATUSID=case(WORKFLOWSTATUSID==0,"Finished", WORKFLOWSTATUSID==1, "In Progress", WORKFLOWSTATUSID==4, "Error",WORKFLOWSTATUSID==7,"Failed", 1=1, "Other") 
 | timechart mean(percent) as percent by WORKFLOWSTATUSID usenull=f span=7d

index=pmc sourcetype=stash source="PDL Per*" WORKFLOWSTATUSID!=1 earliest=-6mon@w
 | eval WORKFLOWSTATUSID=case(WORKFLOWSTATUSID==0,"Finished", WORKFLOWSTATUSID==1, "In Progress", WORKFLOWSTATUSID==4, "Error",WORKFLOWSTATUSID==7,"Failed", 1=1, "Other") 
 | bin _time span=7d
 | chart mean(percent) as percent by _time WORKFLOWSTATUSID usenull=f

Re: Timechart results in to week buckets - keeps forcing monthly

999chris — Thu, 16 Mar 2017 12:20:28 GMT

Cheers cmerriman.

The latter option worked. Am I right in saying its bizarre that my original query was duff?

Re: Timechart results in to week buckets - keeps forcing monthly

mattymo — Thu, 16 Mar 2017 13:09:26 GMT

did you try moving span ?

 | timechart span=7d mean(percent) as percent by WORKFLOWSTATUSID usenull=f

If I recall correctly, order matters here

Re: Timechart results in to week buckets - keeps forcing monthly

jkat54 — Thu, 16 Mar 2017 15:06:09 GMT

That was my first thought too