I have a search that categorizes results according to the response time and buckets them in 1000. I have 0-1000 and 1000-2000 and 3000-4000 and so on. It appears perfectly, but I never have 2000-3000 appear any help?
index=gasf host="*hub-vpn*" uri_path="*default.aspx" referer!="*SSOLogon*" | rex "(?<response_time>\d+)\s[\-\+]$" | eval resTimeInMS=round((response_time/1000),2) | bucket resTimeInMS span=1000 | timechart span=15m c by resTimeInMS usenull=f
It does not appear because you have no values. The fillnull
directive applies to the axes
, not to the number of lines in the chart. Your 'by' field is resTimeInMS
so the lines plotted will be only those for which this field has values. Think about it: if you were plotting by host
how would you expect timechart
to "fill in gaps" in host
values? The only way to solve this is to use append
to force each range value to have an entry by appending exactly 1 event in each 15-minute span and then subtracting one from each before you plot it. I will have the implementation of this solution as an exercise for the OP.
If you leave the bucket out of your search, is there data in that range?
its probabely to not get all captions, but do you have some data presented in this graphe for this interval right?