Knowledge Management

timechart count against si gives different max results for 2 intervals

Starlette
Contributor

I have si search "save" for every 5 mins as :

search = sourcetype="cisco_firewall" | sitimechart count

When running a report for last hour :
search = index=summary marker=cisco_firewall_05 | timechart count

I get line which is 200.000 events

BUT when i ran a "last 4 hours", I get a line in the +1milion count.
I doubt that i am using count over time wrong with si or is this unexpexted behaviour.

if I take a look at a slice for 5 mins in e.g. last 30 mins i get

10/10/11 11:30:00.000 AM 248483
10/10/11 11:31:00.000 AM 252576
10/10/11 11:32:00.000 AM 256538
10/10/11 11:33:00.000 AM 249775
10/10/11 11:34:00.000 AM 246672
10/10/11 11:35:00.000 AM 245773

And for last 4 hours i see 5 minutes bins wich are give the totals...

10/10/11 9:45:00.000 AM 1166499
10/10/11 9:50:00.000 AM 1201649
10/10/11 9:55:00.000 AM 1170088
10/10/11 10:00:00.000 AM 1186497
10/10/11 10:05:00.000 AM 1189967

So how to deal with this?

Tags (1)
0 Karma
1 Solution

Drainy
Champion

I would try setting the span on the timechart command as you may find it is trying to figure one out itself which is giving inconsistent results.
Try span=5m to test 🙂

View solution in original post

Drainy
Champion

I would try setting the span on the timechart command as you may find it is trying to figure one out itself which is giving inconsistent results.
Try span=5m to test 🙂

Starlette
Contributor

yeah that was the trick,,,,After the + hours the span=5 minutes is added, so thats why within the hour the results are 1/5 off ( just use 1 minute)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...