topic Bucket time span causing incorrect date entries in Splunk Search

Bucket time span causing incorrect date entries

ohlafl — Wed, 29 Jul 2015 09:38:35 GMT

I have the following query:

some query... | bucket _time span=1d | eval date=strftime(_time, "%b %d, %Y") | chart avg(value) as Value over date

Which is tethered to the following time span:

 <earliest>-$global_time$d@d</earliest>
 <latest>-1@d</latest>

Where global_time can be any integer representing a number of days.

The data that comes out is correct but the statistics (and therefor visualization) always show the first day of the current month as the first entry, if I search over let's say 40 days I get the following result:

1st July ... 28th July, 24th June, 25th June, 26th June, 29th June... until 40 posts has been filled. What is wrong here???

Weekends are not included as there is no output data for Value during those days.

Re: Bucket time span causing incorrect date entries

woodcock — Wed, 29 Jul 2015 10:48:47 GMT

It is because your date field is being sorted alphabetically and "1" always comes first. Try this:

some query... | bucket _time span=1d | eval date=_time | fieldformat date=strftime(date, "%b %d, %Y") | chart avg(value) as Value over date

Re: Bucket time span causing incorrect date entries

ohlafl — Wed, 29 Jul 2015 13:29:35 GMT

Thank you.