topic Re: How to correct timechart after upgrading in Splunk Search

How to correct timechart after upgrading

Jaylon — Fri, 15 Apr 2022 03:00:29 GMT

timechart [stats count | eval range="$timeRange$" | eval search=case(range=="-6h", "span=30m ", range=="-1d", "span=1h ", range=="-3d", "span=2h ", range=="-7d", "span=4h ")] can't work after upgrade splunk from 8.0.6 to 8.2.5.

Re: How to correct timechart after upgrading

PickleRick — Fri, 15 Apr 2022 05:01:34 GMT

Regardless of update I don't see this search working properly unles you were very very lucky so far.

The subsearch starts with "stats count". Since you don't specify any command, it's treated as arguments for the implicit search command. So you're searching for the events containing both words "stats" and "count" in your user's default index using time picker's timerange. It's probably not what you wanted.

You might want to start your search with "| makeresults" instead of this search.

Re: How to correct timechart after upgrading

VatsalJagani — Fri, 15 Apr 2022 08:18:59 GMT

@Jaylon - Try something like the below as suggested by @PickleRick

timechart [| makeresults | eval range="$timeRange$" | eval search=case(range=="-6h", "span=30m ", range=="-1d", "span=1h ", range=="-3d", "span=2h ", range=="-7d", "span=4h ")]

Re: How to correct timechart after upgrading

ITWhisperer — Fri, 15 Apr 2022 09:55:55 GMT

It looks like you are trying to set the span based on the value of a token. Why not create a additional token at the same time as the timeRange token based on the options you want?

<eval token="span">case($timeRange$=="-6h", "span=30m ", $timeRange$=="-1d", "span=1h ", $timeRange$=="-3d", "span=2h ", $timeRange$=="-7d", "span=4h ")</eval> timechart $span$