topic Re: How to define chart end time? Missing data is displayed as blank space. in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-define-chart-end-time-Missing-data-is-displayed-as-blank/m-p/176455#M50675 <P>I wasn't able to reproduce the behavior - my timechart ends on the day the data ends. Can you share your search?</P> <P>Also, <A href="http://docs.splunk.com/Documentation/Splunk/6.2.4/Search/Specifytimemodifiersinyoursearch">the docs</A> say that</P> <PRE><CODE>In general, you won't specify "latest" without an "earliest" time. </CODE></PRE> <P>I've seen weird behavior when setting only <CODE>latest</CODE>, although I believe this implicity sets <CODE>earliest=1</CODE>, i.e. all time. Have you tried setting <CODE>earliest</CODE> explicitly as well? That could clear things up.</P> Tue, 18 Aug 2015 09:08:55 GMT jeffland 2015-08-18T09:08:55Z How to define chart end time? Missing data is displayed as blank space. https://community.splunk.com/t5/Splunk-Search/How-to-define-chart-end-time-Missing-data-is-displayed-as-blank/m-p/176454#M50674 <P>I have events that are delayed by some time that I want to plot in a chart. Let's say there is a 1 hour delay. </P> <P>How to configure the chart to not display that hour as blank space? </P> <P>I've already configured latest=-1h in my query -- but the chart insists on plotting latest=now.</P> Mon, 17 Aug 2015 22:47:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-define-chart-end-time-Missing-data-is-displayed-as-blank/m-p/176454#M50674 the_wolverine 2015-08-17T22:47:37Z Re: How to define chart end time? Missing data is displayed as blank space. https://community.splunk.com/t5/Splunk-Search/How-to-define-chart-end-time-Missing-data-is-displayed-as-blank/m-p/176455#M50675 <P>I wasn't able to reproduce the behavior - my timechart ends on the day the data ends. Can you share your search?</P> <P>Also, <A href="http://docs.splunk.com/Documentation/Splunk/6.2.4/Search/Specifytimemodifiersinyoursearch">the docs</A> say that</P> <PRE><CODE>In general, you won't specify "latest" without an "earliest" time. </CODE></PRE> <P>I've seen weird behavior when setting only <CODE>latest</CODE>, although I believe this implicity sets <CODE>earliest=1</CODE>, i.e. all time. Have you tried setting <CODE>earliest</CODE> explicitly as well? That could clear things up.</P> Tue, 18 Aug 2015 09:08:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-define-chart-end-time-Missing-data-is-displayed-as-blank/m-p/176455#M50675 jeffland 2015-08-18T09:08:55Z