topic Re: Not getting by day results for a timechart in Splunk Search

Not getting by day results for a timechart

di2esysadmin — Tue, 18 Feb 2014 17:28:56 GMT

I'm banging my head against the wall. Here's my search:

host="atlassian-stash*" sourcetype=atlassian source="/opt/atlassian/stash-data/log/atlassian-stash-access*.log" | timechart dc(stash_users) span=1d AS "Unique Stash Users"

stash_users is an extracted field. Pretty clear from search results that it's working correctly.

When I run the above, I get 8 results (as though it thinks it's giving me by day results) the only days with values are 2/18 and 2/11. As though it's counting unique stash_users by week.

I have this precise format working with a different extracted field on a different file. Hence the head banging.

Help appreciated.

Karla

Re: Not getting by day results for a timechart

linu1988 — Mon, 28 Sep 2020 15:55:17 GMT

What do you get if you just make a |bucket _time span=1d| stats dc(stash_users) by _time instead of timechart?

Re: Not getting by day results for a timechart

yannK — Tue, 18 Feb 2014 18:25:32 GMT

Just for sanity,

change the order of your timechart to avoid having the span between the function and the "AS"
| timechart span=1d dc(stash_users) AS "Unique Stash Users"

Re: Not getting by day results for a timechart

linu1988 — Tue, 18 Feb 2014 18:27:31 GMT

This is it 😄

Re: Not getting by day results for a timechart

yannK — Tue, 18 Feb 2014 18:33:44 GMT

good, @di2esysadmin please accept the answer to mark it as resolved.

Re: Not getting by day results for a timechart

di2esysadmin — Mon, 28 Sep 2020 15:55:20 GMT

Didn't fix it. Here's my query now:

host="atlassian-stash*" sourcetype=atlassian source="/opt/atlassian/stash-data/log/atlassian-stash-access*.log" | timechart span=1d dc(stash_users) AS "Unique Stash Users"

Re: Not getting by day results for a timechart

di2esysadmin — Tue, 18 Feb 2014 19:59:45 GMT

No change in behavior. 😞

Re: Not getting by day results for a timechart

linu1988 — Mon, 28 Sep 2020 15:55:23 GMT

what do u get by host="atlassian-stash"

sourcetype=atlassian source="/opt/atlassian/stash-data/log/atlassian-stash-access.log"|bucket _time span=1d| stats dc(stash_users) by _time?

Re: Not getting by day results for a timechart

di2esysadmin — Tue, 18 Feb 2014 20:02:36 GMT

There has to be a problem with the way I've extracted the field. It's too simple for it to be anything else.

Re: Not getting by day results for a timechart

di2esysadmin — Tue, 18 Feb 2014 20:07:00 GMT

That's it! The problem is my field extraction. It was based on a filename. The entries for the others days came from log files with a different named format.

Thanks for the ideas!