topic Re: Inexplicable extra chart data point? in Splunk Search

Inexplicable extra chart data point?

arichman — Wed, 17 Dec 2014 01:10:48 GMT

I have multiple searches over a year's date range, similar to:
base search | timechart span=1month dc(foo)

and they are all reproducing the same strange statistics, and in turn visualization...

all of the data is grouped by month, but the very last month is repeated twice, time stamps 7 hours apart, and the values for the first of those points being incomplete
_time count
2013-12-01 00:00 100
2013-12-01 08:00 200
2014-01-01 08:00 300
2014-02-01 08:00 400
2014-03-01 08:00 500
2014-04-01 07:00 600
2014-05-01 07:00 700
2014-06-01 07:00 800
2014-07-01 07:00 900
2014-08-01 07:00 1000
2014-09-01 07:00 1100
2014-10-01 07:00 1200
2014-11-01 00:00 250
2014-11-01 07:00 1300

Is this expected behavior? If so, I would greatly appreciate any assistance with cleaning it up!

Thanks very much

Re: Inexplicable extra chart data point?

musskopf — Wed, 17 Dec 2014 01:17:29 GMT

I believe this is the behavior for the partial=true, which is the default. From the timechart documentation:

partial
Syntax: partial=
Description: Controls if partial time buckets should be retained or not. Only the first and last bucket could ever be partial. Defaults to True|T, meaning that they are retained.

Try to use:

base search | timechart partial=f span=1month dc(foo)

base search | bucket span=1mon _time | timechart span=1month dc(foo)

Re: Inexplicable extra chart data point?

arichman — Wed, 17 Dec 2014 01:40:31 GMT

That appears to do the trick. Thank you!

Re: Inexplicable extra chart data point?

arichman — Wed, 17 Dec 2014 22:13:58 GMT

Specifically, the second example worked for me.