https://community.splunk.com/t5/Splunk-Search/Not-getting-the-last-week-of-data-in-graph-when-using-the-filter/m-p/612194#M212842 <P>So, the chart is providing the correct result. Splunk is not particular good at displaying things which don't exist. You can force it to by artificially adding events (with zero counts for example), but you have to tell Splunk which events you want adding.</P> Wed, 07 Sep 2022 06:43:14 GMT ITWhisperer 2022-09-07T06:43:14Z https://community.splunk.com/t5/Splunk-Search/Not-getting-the-last-week-of-data-in-graph-when-using-the-filter/m-p/612184#M212835 <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="uagraw01_0-1662527805116.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/21347i6A860CE096DD4733/image-size/medium?v=v2&amp;px=400" role="button" title="uagraw01_0-1662527805116.png" alt="uagraw01_0-1662527805116.png" /></span></P> <P><SPAN>In the above, I am comparing the last 15m data to the current week's 15m data. And I am getting good results.</SPAN></P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="uagraw01_1-1662527958772.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/21348i4899A8E337B98655/image-size/medium?v=v2&amp;px=400" role="button" title="uagraw01_1-1662527958772.png" alt="uagraw01_1-1662527958772.png" /></span></P> <P>&nbsp;</P> <P>But here in the same search when I am using the filter search Device_Type="mobile", I am not getting the last week of data in graph. Please help me out for this.</P> <P>&nbsp;</P> <P>&nbsp;</P> Wed, 07 Sep 2022 15:51:28 GMT https://community.splunk.com/t5/Splunk-Search/Not-getting-the-last-week-of-data-in-graph-when-using-the-filter/m-p/612184#M212835 uagraw01 2022-09-07T15:51:28Z https://community.splunk.com/t5/Splunk-Search/Not-getting-the-last-week-of-data-in-graph-when-using-the-filter/m-p/612185#M212836 <P>This would seem to suggest that you have no events from last week for this device type - have you checked that there are actually events to be found?</P> Wed, 07 Sep 2022 05:53:49 GMT https://community.splunk.com/t5/Splunk-Search/Not-getting-the-last-week-of-data-in-graph-when-using-the-filter/m-p/612185#M212836 ITWhisperer 2022-09-07T05:53:49Z https://community.splunk.com/t5/Splunk-Search/Not-getting-the-last-week-of-data-in-graph-when-using-the-filter/m-p/612188#M212838 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/70277">@uagraw01</a>,</P><P>there's only one answer: you haven't events that match the condition on week ago.</P><P>You can check this running your search only on the first time frame.</P><P>Ciao.</P><P>Giuseppe</P> Wed, 07 Sep 2022 06:07:20 GMT https://community.splunk.com/t5/Splunk-Search/Not-getting-the-last-week-of-data-in-graph-when-using-the-filter/m-p/612188#M212838 gcusello 2022-09-07T06:07:20Z https://community.splunk.com/t5/Splunk-Search/Not-getting-the-last-week-of-data-in-graph-when-using-the-filter/m-p/612192#M212840 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp; &amp; <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/161352">@gcusello</a>&nbsp;Yes, I can see no events for deviceType for last week. Those events appended to Splunk from 1st sep.</P> Wed, 07 Sep 2022 06:27:28 GMT https://community.splunk.com/t5/Splunk-Search/Not-getting-the-last-week-of-data-in-graph-when-using-the-filter/m-p/612192#M212840 uagraw01 2022-09-07T06:27:28Z https://community.splunk.com/t5/Splunk-Search/Not-getting-the-last-week-of-data-in-graph-when-using-the-filter/m-p/612193#M212841 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/70277">@uagraw01</a>,</P><P>if you haven't events that match the added condition, you have only to modify the search condition or accept these results.</P><P>Ciao.</P><P>Giuseppe</P> Wed, 07 Sep 2022 06:34:41 GMT https://community.splunk.com/t5/Splunk-Search/Not-getting-the-last-week-of-data-in-graph-when-using-the-filter/m-p/612193#M212841 gcusello 2022-09-07T06:34:41Z https://community.splunk.com/t5/Splunk-Search/Not-getting-the-last-week-of-data-in-graph-when-using-the-filter/m-p/612194#M212842 <P>So, the chart is providing the correct result. Splunk is not particular good at displaying things which don't exist. You can force it to by artificially adding events (with zero counts for example), but you have to tell Splunk which events you want adding.</P> Wed, 07 Sep 2022 06:43:14 GMT https://community.splunk.com/t5/Splunk-Search/Not-getting-the-last-week-of-data-in-graph-when-using-the-filter/m-p/612194#M212842 ITWhisperer 2022-09-07T06:43:14Z