Deployment Architecture

Bucket _time span=day and Date Time Range Issue


I have the following source:

     <input type="time" token="timeRange" searchWhenChanged="true">
      <label>Select Time Range:</label>
          <query>host=$host$ source="/etc/myproject/logs/myproject.log" "msgType=Notification" |bucket _time span=day |stats count by _time</query>

I see correct results in visualization, but when I click on any of the results on chart, the drilldown doesn't the results because the Date Time Range is rendered incorrect. I see zero results for the search query as Date Time Range is
(21/03/2019 00:00:00.000 to 21/03/2019 00:00:00.01).

How to overcome this and get the right time range?

0 Karma

Re: Bucket _time span=day and Date Time Range Issue



It seems like bucket/bin always snaps to the date on drilldown and does not give the range.

You may try timechart span=day count which should give you events from the start of the day to end of day.

<query>host=$host$ source="/etc/myproject/logs/myproject.log" "msgType=Notification" |timechart span=day count</query>

Try and verify your results.

View solution in original post

0 Karma