topic Re: How to build time charts using Hunk? in Splunk Search

How to build time charts using Hunk?

wonderz44 — Tue, 02 Jun 2015 05:00:25 GMT

I have read about the limitations on using Hunk (http://docs.splunk.com/Documentation/Hunk/6.2.3/Hunk/Searchavirtualindex#How_Hunk_reporting_uses_search_language)

but is there a way to set up time charts and bucket by time in Hunk?

My Hunk queries work fine on the virtual index when I run them in search but adding them to dashboard, all search results are combined into a single out of range, one hour bucket.

Re: How to build time charts using Hunk?

Ledion_Bitincka — Tue, 02 Jun 2015 07:54:11 GMT

Can you elaborate on what you mean by "My Hunk queries work fine on the virtual index when I run them in search "? Is timestamp extracted correctly when you run a simple search like "index=vix | head 10", but not when using timechart? Also, what data format are you working with?

Re: How to build time charts using Hunk?

wonderz44 — Tue, 02 Jun 2015 23:13:53 GMT

I am working with .csv syslog file stored on Hadoop.

I have setup a virtual index for the file.

When I try the queries in search app and Verbose mode, I get the correct result. But the dashboard runs in either fast or smart mode (can't verify which one) so instead of picking the correct time stamp, it picks the last touch time of the file on Hadoop.

Re: How to build time charts using Hunk?

Ledion_Bitincka — Tue, 02 Jun 2015 23:23:37 GMT

You're probably running into an issue related to with time stamp extraction and field projection (only picking the required field) - for more info see this thread

The fix for this would be tell Hunk to always output the field(s) from which the timestamp is extracted, for example

 [vix]
....
vix.input.1.required.fields = Date