HiddenPostProcess Search Time Range changed.

[Joshua]

I am currently running a single hidden search to power all the graphs on my dashboard.

The time range for the base search is 3 hours.

  <module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" autoRun="True">
  <param name="savedSearch">Search Base</param>

The PostProcess then does another search to filter the results, which also works correctly.

However when the time chart is created the MIN & MAX Time Range is changed to first/last seen events, when I need it to stay as 3 Hours.

It works correctly if I run the search manually, is there something I'm missing?

<module name="HiddenPostProcess" layoutPanel="panel_row2_col1_grp1">
 <param name="search"> search page="www.homepage.com" | timechart span="5m" count by Status_Code | fillnull value=0 </param>

<module name="HiddenChartFormatter">
      <param name="chart">bar</param>
      <param name="charting.axisY.minimumNumber"> </param>
      <param name="charting.axisY.maximumNumber"> </param>
      <param name="charting.chart.axisX.includeZero">true</param>
      <param name="charting.chart.nullValueMode">zero</param>
      <param name="charting.legend.labels">[500,404,200]</param>
      <param name="charting.seriesColors">[0xFF0000,0xFFE87C,0x41A317]</param>
      <param name="charting.legend.masterLegend"></param>
     <param name="charting.primaryAxisLabels.majorLabelVisibility">hide</param>
      <param name="charting.chart.stackMode">stacked</param>
      <param name="primaryAxisTitle.text"> </param>
      <param name="secondaryAxisTitle.text"> </param>
      <param name="legend.placement">top</param>
        <module name="FlashChart">
          <param name="width">100%</param>
          <param name="height">435px</param>
        </module>
    </module>

Any thoughts would be helpful!

Thanks.

[sideview]

I can confirm that this is still an issue in 4.3, but note that it's only an issue if your saved search is loading from a previously scheduled search.

If your savedsearch has no jobs saved from previously scheduled runs, or if you set the useHistory param to "False", the bug will go away. Likewise if the search is not a saved search at all but just a regular inline search. In those cases the timechart command applied by HiddenPostProcess does not have this "clamping in" effect.

as for fixedrange=false, it's definitely a related param, but it isn't the solution in this case. Actually note that in a normal search setting fixedrange to false in timechart will actually create this behavior, not turn it off. And I checked just to be sure and adding that to the postprocess'ed timechart doesn't seem to fix the behavior.

I also tried some weird tricks like adding addinfo to the base search, to see if I could get the base job to have whatever secret info that the ad-hoc searches have, that makes the postProcess not do this. However I had no luck. Maybe someone else can comment.

[sideview]

Note that the charting.chart.axisY.includeZero should be "charting.axisY.includeZero". "charting.chart.axisY.includeZero" will have no effect.

[batzel]

I was running through a similar problem, and the solution turned out to be to add "fixedrange=false" to my timechart command. It seems we're running Splunk 4.1, and this makes the chart grow or shrink to fit the data being fed into it, rather than being stuck at the definition of earliest/latest.