Seach query for timeseries does not work for all timeranges

[rantravee]

Hi,

I'm using a script to poll at each minute a WebApi for statistics. The result is a json object that is then indexed into Splunk. Next I want to visualize some of the statistics, therefore I employ a couple of dashboards/forms , each coupled with a search to render timeseries about that statistic.

The search query is like "source="mysource" | timechart span=1m avg(json_response.statistic_x)"

This works OK for some time ranges (15min, 60min, 4h) but for 24h interval or greater nothing is plotted. It is like in this case no event matches the query which is very strange,since there is data.

If I remove the span then for the 15 min interval I get around 15 unconnected points in the graph representing each indexed event. Additionally in this case I see there are much more results than matching events.

Could someone throw some light on what is happening and how could a consistent behavior for all time samples be obtained ?

[lguinn2]

I think that you can't get a consistent behavior for all time samples, because you just have too many data points in the longer intervals. Splunk may be able to compute the data using stats, but it can't display that data in a timechart unless you change the span.

Here is an old quote, but I think it is still true:

"Splunk's chart rendering subsystem is configured to only show 500 data rows by default, as each point takes a couple of pixels and it's unlikely that your display device has more than a few thousand pixels. I'm assuming that your table below the chart shows all 2160 rows of data."

from http://answers.splunk.com/answers/5109/forcing-report-to-chart-last-month-of-data