Deployment Architecture

Using the bucket command, why doesn't one bucket range appear?

rana_nour
Explorer

I have a search that categorizes results according to the response time and buckets them in 1000. I have 0-1000 and 1000-2000 and 3000-4000 and so on. It appears perfectly, but I never have 2000-3000 appear any help?

index=gasf  host="*hub-vpn*" uri_path="*default.aspx" referer!="*SSOLogon*"  | rex "(?<response_time>\d+)\s[\-\+]$" | eval resTimeInMS=round((response_time/1000),2) | bucket resTimeInMS span=1000   | timechart span=15m c by resTimeInMS usenull=f  
Tags (1)
0 Karma

woodcock
Esteemed Legend

It does not appear because you have no values. The fillnull directive applies to the axes, not to the number of lines in the chart. Your 'by' field is resTimeInMS so the lines plotted will be only those for which this field has values. Think about it: if you were plotting by host how would you expect timechart to "fill in gaps" in host values? The only way to solve this is to use append to force each range value to have an entry by appending exactly 1 event in each 15-minute span and then subtracting one from each before you plot it. I will have the implementation of this solution as an exercise for the OP.

0 Karma

jeffland
SplunkTrust
SplunkTrust

If you leave the bucket out of your search, is there data in that range?

0 Karma

otman01
Communicator

its probabely to not get all captions, but do you have some data presented in this graphe for this interval right?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...