Dashboards & Visualizations

Seach query for timeseries does not work for all timeranges

Path Finder


I'm using a script to poll at each minute a WebApi for statistics. The result is a json object that is then indexed into Splunk. Next I want to visualize some of the statistics, therefore I employ a couple of dashboards/forms , each coupled with a search to render timeseries about that statistic.

The search query is like "source="mysource" | timechart span=1m avg(json_response.statistic_x)"

This works OK for some time ranges (15min, 60min, 4h) but for 24h interval or greater nothing is plotted. It is like in this case no event matches the query which is very strange,since there is data.

If I remove the span then for the 15 min interval I get around 15 unconnected points in the graph representing each indexed event. Additionally in this case I see there are much more results than matching events.

Could someone throw some light on what is happening and how could a consistent behavior for all time samples be obtained ?

0 Karma


I think that you can't get a consistent behavior for all time samples, because you just have too many data points in the longer intervals. Splunk may be able to compute the data using stats, but it can't display that data in a timechart unless you change the span.

Here is an old quote, but I think it is still true:

"Splunk's chart rendering subsystem is configured to only show 500 data rows by default, as each point takes a couple of pixels and it's unlikely that your display device has more than a few thousand pixels. I'm assuming that your table below the chart shows all 2160 rows of data."

from http://answers.splunk.com/answers/5109/forcing-report-to-chart-last-month-of-data

Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...