Deployment Architecture

Bucket _time span=day and Date Time Range Issue

ananth402
Explorer

I have the following source:

  </input>
     <input type="time" token="timeRange" searchWhenChanged="true">
      <label>Select Time Range:</label>
      <default>
        <earliest>0</earliest>
        <latest></latest>
      </default>
    </input>...
        <search>
          <query>host=$host$ source="/etc/myproject/logs/myproject.log" "msgType=Notification" |bucket _time span=day |stats count by _time</query>
          <earliest>$timeRange.earliest$</earliest>
          <latest>$timeRange.latest$</latest>
        </search>

I see correct results in visualization, but when I click on any of the results on chart, the drilldown doesn't the results because the Date Time Range is rendered incorrect. I see zero results for the search query as Date Time Range is
(21/03/2019 00:00:00.000 to 21/03/2019 00:00:00.01).

How to overcome this and get the right time range?

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@ananth402,

It seems like bucket/bin always snaps to the date on drilldown and does not give the range.

You may try timechart span=day count which should give you events from the start of the day to end of day.

<query>host=$host$ source="/etc/myproject/logs/myproject.log" "msgType=Notification" |timechart span=day count</query>

Try and verify your results.

Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@ananth402,

It seems like bucket/bin always snaps to the date on drilldown and does not give the range.

You may try timechart span=day count which should give you events from the start of the day to end of day.

<query>host=$host$ source="/etc/myproject/logs/myproject.log" "msgType=Notification" |timechart span=day count</query>

Try and verify your results.

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...