https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-change-the-span-parameter-for-a-timechart/m-p/165411#M46999 <P>I tried the following and getting unexpected results.</P> <P>Here is my query:<BR /> searchquery | timechart bins=10 avg(responseTime)</P> <P>I expect the x-axis to be divided into 10 bins/sections. In other words, if i use a bar/column chart for visualization, i expect 10 bars. However, I see only 3 bars. <BR /> Is my understanding/expectation incorrect?</P> Thu, 02 Apr 2015 04:26:26 GMT vdevarayan 2015-04-02T04:26:26Z https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-change-the-span-parameter-for-a-timechart/m-p/165408#M46996 <P>I have a dashboard panel that will display all events (for a given search)<BR /> The result set may contain 100 or 10,000 events (assume one event for every second).<BR /> If it is just 100, i would like to have span=1s.<BR /> If it is 1,000, then i would like to have span=1m</P> <P>How to dynamically change the span parameter in this scenario?<BR /> Basically, how to find out the best timespan so that it fits inside the 1000 event limit imposed by Splunk to avoid truncation happening?</P> <P>thanks</P> Fri, 06 Mar 2015 10:38:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-change-the-span-parameter-for-a-timechart/m-p/165408#M46996 vdevarayan 2015-03-06T10:38:50Z https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-change-the-span-parameter-for-a-timechart/m-p/165409#M46997 <P>One option is to use <CODE>bins=1000</CODE>, which will divide the timechart into up to 1000 buckets. See <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Timechart#Optional_arguments">http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Timechart#Optional_arguments</A></P> <P>Is this what you are looking for?</P> Fri, 06 Mar 2015 11:43:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-change-the-span-parameter-for-a-timechart/m-p/165409#M46997 laserval 2015-03-06T11:43:39Z https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-change-the-span-parameter-for-a-timechart/m-p/165410#M46998 <P>I agree with you.</P> <P>Bins is the only argument that I can see for the timechart command that will be ideal for your situation.</P> <P>35 should be good if you require about a month span.</P> Fri, 06 Mar 2015 12:08:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-change-the-span-parameter-for-a-timechart/m-p/165410#M46998 markthompson 2015-03-06T12:08:07Z https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-change-the-span-parameter-for-a-timechart/m-p/165411#M46999 <P>I tried the following and getting unexpected results.</P> <P>Here is my query:<BR /> searchquery | timechart bins=10 avg(responseTime)</P> <P>I expect the x-axis to be divided into 10 bins/sections. In other words, if i use a bar/column chart for visualization, i expect 10 bars. However, I see only 3 bars. <BR /> Is my understanding/expectation incorrect?</P> Thu, 02 Apr 2015 04:26:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-change-the-span-parameter-for-a-timechart/m-p/165411#M46999 vdevarayan 2015-04-02T04:26:26Z https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-change-the-span-parameter-for-a-timechart/m-p/165412#M47000 <P>I downvoted this post because incorrect answer, bins option just define a maximun number of bins, no the target number.</P> Fri, 13 Nov 2015 12:52:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-change-the-span-parameter-for-a-timechart/m-p/165412#M47000 gfuente 2015-11-13T12:52:32Z https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-change-the-span-parameter-for-a-timechart/m-p/165413#M47001 <P>I valid solution is:</P> <P>index=main | timechart <STRONG>[ search index=_internal | head 1 | addinfo | eval span=ceil((info_max_time-info_min_time)/1000)."s" | return span]</STRONG> count </P> <P>The subsearch calculates dinamically the maximum period in sec, to get 1000 bins</P> <P>Regards</P> Tue, 29 Sep 2020 07:54:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-change-the-span-parameter-for-a-timechart/m-p/165413#M47001 gfuente 2020-09-29T07:54:44Z https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-change-the-span-parameter-for-a-timechart/m-p/165414#M47002 <P>I downvoted this post because sadly this does not work as expected. bins=1000 means that splunk will determine some arbitrary number of bins that is less than 1000.</P> Fri, 31 Mar 2017 15:47:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-change-the-span-parameter-for-a-timechart/m-p/165414#M47002 benton 2017-03-31T15:47:27Z