topic Re: How does 'partial=True' affects 'timechart' results? in Splunk Search

How does 'partial=True' affects 'timechart' results?

abonuccelli_spl — Tue, 01 Jul 2014 08:37:22 GMT

I am grouping time buckets using 'span' and I'd like to trim partial time buckets at the beginning and end of the search of the time line as they're not representative of a full span period

Re: How does 'partial=True' affects 'timechart' results?

abonuccelli_spl — Tue, 01 Jul 2014 08:38:38 GMT

Below the difference in how results are presented (or omitted)

partial=False

user@workstation-486-DX2-66 /opt/splunk/bin $ ./splunk search "sourcetype=psql-lab-dbx_feeder_tsb_7848 earliest=-20m@m | timechart span=5m count partial=False"
INFO: Your timerange was substituted based on your search string
           _time            count
--------------------------- -----
2014-07-01 09:15:00.000 BST   310
2014-07-01 09:20:00.000 BST   546
2014-07-01 09:25:00.000 BST   577

partial=True

user@workstation-486-DX2-66 /opt/splunk/bin $ ./splunk search "sourcetype=psql-lab-dbx_feeder_tsb_7848 earliest=-20m@m | timechart span=5m count partial=True"
INFO: Your timerange was substituted based on your search string
           _time            count
--------------------------- -----
2014-07-01 09:10:00.000 BST     0
2014-07-01 09:15:00.000 BST   310
2014-07-01 09:20:00.000 BST   546
2014-07-01 09:25:00.000 BST   577
2014-07-01 09:30:00.000 BST   533

Re: How does 'partial=True' affects 'timechart' results?

andreyminakov — Sat, 22 Apr 2017 22:49:26 GMT

It doesn't work in my case...

Re: How does 'partial=True' affects 'timechart' results?

andreyminakov — Sat, 22 Apr 2017 22:55:05 GMT

I understood the principle of "partial" working exactly as maciep, and I don't see anything opposite in documentation. The only suspicious thing is that it is said in the documentation that «Only the first and last bin can be partial.». As far as I understand, the first and the last bins have always be consider as partial. Otherwise the system has to have some logic to understand where the first or/and last bins are partial or not. And IMHO this is impossible, because the software cannot understand whether e.g. the first period is incomplete, or there just really weren’t any events during the first part of this first bean.

The same issue is here:
https://answers.splunk.com/answers/432520/why-is-timechart-partialfalse-still-returning-part.html
https://answers.splunk.com/answers/418447/how-is-the-partial-flag-supposed-to-work-with-time.html

So it would be great to solve that issue.