Dashboards & Visualizations

_Span and _Spandays columns in result set

strive
Influencer

Hi,

I have a search macro. It is used to display charts.

......| timechart partial=false span=$span$ limit=0 usenull=f useother=f per_second(StatusCodeCount) as "Error/Sec" by rate

When i click on view results i get two columns in tabular format. _time and rate. This is fine.

But, when i try to get the results from same search using REST API, i get additional columns _span and _spandays. I searched for these fields in internet, i did not get much info.

Could you please help me understand why additional columns are shown.

Thanks
Strive

Tags (1)

yannK
Splunk Employee
Splunk Employee

Try to remove them with :

<mysearch> | fields -_span -_spandays

strive
Influencer

Same search behaves different in two interfaces. I would like to know why additional fields are present when search is executed through one interface and not in another.

Moreover i did not find any splunk documentation related to _span and _spandays in internet.

Am i missing something here or is it a bug in splunk?

0 Karma

kartik13
Communicator

are you getting the result set same as the GUI

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...