topic Re: -1 value at _time field using timechart in Splunk Search

-1 value at _time field using timechart

guimilare — Tue, 25 Oct 2016 13:48:59 GMT

Hello Splunkers.

I'm having an issue with timechart;

Scenario:
I have a index that contains summarized data.
I want to create a timechart showing the sum of bytes used.
However, in the field _time, I get some dates OK and then I get a -1 value. After that, _time goes back to start of the epoch time:

At first I imagined that it was related to summarization issues, but the same occurs on the data indexed directly from the ironports.
Have you guys ever seen something like that?

Thanks in advance!

Re: -1 value at _time field using timechart

cmerriman — Tue, 25 Oct 2016 13:51:53 GMT

are you piping right after the timechart command?

Re: -1 value at _time field using timechart

guimilare — Tue, 25 Oct 2016 13:54:37 GMT

This is my search:

index=wsa_ironport name_subnet="XXX" | timechart sum(eval(round(bytes_in/1048576,3))) as traffic by name_subnet

Re: -1 value at _time field using timechart

sundareshr — Tue, 25 Oct 2016 13:57:38 GMT

It seems like '_time' is not getting indexed correctly from raw data. Do you see correct time values in the events returned by your base search

index=wsa_ironport name=zyx  | table _time _raw

Re: -1 value at _time field using timechart

cmerriman — Tue, 25 Oct 2016 13:59:15 GMT

ahh alright, that picture looked like there was a pipe in there.

I assume it's ...|timechart span=1d sum(eval...

I'd double check the _raw data to make sure that _time is being indexed correctly.

Re: -1 value at _time field using timechart

guimilare — Tue, 25 Oct 2016 14:08:50 GMT

_time seems to be indexed correctly:

I guess a few events were wrongly indexed and are causing this issue.
I have to find these bad buys now.

Any hints?

Re: -1 value at _time field using timechart

guimilare — Tue, 25 Oct 2016 14:24:59 GMT

_time seems to be indexed correctly.
I guess a few events were wrongly indexed and are causing this issue.
I have to find these bad buys now.

Any hints?

Re: -1 value at _time field using timechart

somesoni2 — Tue, 25 Oct 2016 14:34:15 GMT

Do you get any event when you run this?

index=wsa_ironport name_subnet="XXX"  _time<0

Re: -1 value at _time field using timechart

guimilare — Tue, 25 Oct 2016 14:39:22 GMT

Hi semosoni2,
I get 0 results for the search above...
That's why I'm keep thinking if timechart its not recognizing something...

Re: -1 value at _time field using timechart

guimilare — Thu, 03 Nov 2016 18:52:41 GMT

Hi all.

This issue was caused by the start of Daylight Saving Time in Brazil.
SPLUNK reported this as a bug..

The workaround is to add span=24h to the search.