strange timechart effect

[alexeysharkov]

Hello 

I have xml messages in search. row like this

<log><local_time>2025-02-25T15:02:59:955059+05:00</local_time><bik>ATYNKZKA</bik><fileName>stmt_3110449968.pdf</fileName><size>555468</size><iin>800716350670</iin><agrementNumber>3110449968</agrementNumber><agrementDate>08.11.2011</agrementDate><referenceId>HKBRZA0000388473</referenceId><bankCode>ALTYNDBZ</bankCode><result>OK</result></log>

<log><local_time>2025-02-25T15:02:59:885557+05:00</local_time><bik>ATYNKZKA</bik><fileName>stmt_dbz.pdf</fileName><size>152868</size><iin>840625302683</iin><agrementNumber>4301961740</agrementNumber><agrementDate>21.06.2023</agrementDate><referenceId>HKBRZA0000388476</referenceId><bankCode>ALTYNDBZ</bankCode><result>OK</result></log>

 I see after search in field in '_time' and 'log.local_time' date time with seconds and parts. Seems to be OK 

But when i try build timechart i see next

Seems to be timechart don't know about minutes and seconds. And know only hours. My span=5m is ignored.

For me it is ok using _time or log.local_time  

I try various method parse with strptime but useless

thanks

[alexeysharkov]

@ITWhisperer  @gcusello 

My vendor is perfect

hi write 

select
to_char(systimestamp,'YYYY-MM-DD"T"HH24:MM:SS:FFTZH:TZM') now_time from blabla

and use it to save log xml

instead 

to_char(systimestamp,'YYYY-MM-DD"T"HH24:MI:SS:FFTZH:TZM') now_time

so date is incorrect 

I coming to rewrite it

SORRY

[gcusello]

Hi @alexeysharkov ,

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[alexeysharkov]

Hi Giuseppe 

yeap , now span divide timeline correctly but count incorrect. Only at hour i see count

[ITWhisperer]

 Can you share some events which are not in the count?

[alexeysharkov]

@ITWhisperer 

Hello i think all messages counted by count . But spreading is incorrect.

I 've expected count spread on every 5 min (span=5m) but it count spread every hour 

I see time in ROW like this

I have search with another sourcetype. _time format is the same/

And similar timechart is OK spreading with span =5 min  work OK

Dontknoooooww 😞

[ITWhisperer]

Are you saying that this event 13:02:59 is not counted? Or it is counted in the 13:00:00 - 13:04:59 bin?

You haven't shown an event which is in the wrong time bucket yet!

[alexeysharkov]

Ok i get find only one xml event 

search it  index=hcg_app_damu_prod sourcetype=damu_log_dbz_out earliest=-1d | spath | search (log.referenceId=HKBRZA0000389094 AND log.agrementNumber=4303291972)

And then i build timechart 

So event with _time =2025-02-26T14:02:59.970+05:00 

Goes to bucket at 2025-02-26 14:00:00

Im sure my events spread on 5 minutes buckets

I have no Idea why it go to hour bucket's

[ITWhisperer]

Again, this event appears to be in the right bucket. Please provide evidence that you have events in the wrong buckets, otherwise, this seems to be a non-problem 😎

[gcusello]

Hi @alexeysharkov ,

don't use the table command before timechart and please share some raw data.

Ciao.

Giuseppe

[alexeysharkov]

change search without table - useless

Raw data in first message. Just simple XML source

<log><local_time>2025-02-25T17:02:59:979253+05:00</local_time><bik>TSESKZKA</bik><fileName>stmt_4102880506.pdf</fileName><size>238529</size><iin>780515303362</iin><agrementNumber>4102880506</agrementNumber><agrementDate>08.09.2021</agrementDate><referenceId>HKBRZA0000388353</referenceId><bankCode>Jysan bank</bankCode><result>OK</result></log>

<log><local_time>2025-02-25T17:02:59:986891+05:00</local_time><bik>INLMKZKA</bik><fileName>stmt_dbz.pdf</fileName><size>195992</size><iin>710416303014</iin><agrementNumber>4400863944</agrementNumber><agrementDate>17.02.2024</agrementDate><referenceId>HKBRZA0000388352</referenceId><bankCode>Halyk bank</bankCode><result>OK</result></log>

[gcusello]

Hi @alexeysharkov ,

I suppose that _time corresponds to the <local_time>.

please another stupid try: rename log.bankCode in log_bankCode before timecharting and then use this field in the timechart.

could you share your events, with also the _time field?

Ciao.

Giuseppe

[gcusello]

Hi @alexeysharkov ,

i found a similar behavior that changed putting span after the command:

| timechart span=5m count BY log.bankCode

Ciao.

Giuseppe