Splunk Dev

span not working with db query

Esky73
Builder

i have a search like so :

| dbxquery query="SELECT some select statement
| eval u_total_time=u_total_time/1000
| chart avg(u_total_time) over u_real_hit_time by u_short_description span=1m

However the span=1 seems to be ignored and the results are still presenting in second intervals.

I have moved the span cmd to after the chart cmd and also tried using stats and timechart but the span cmd is ignored in all searches.

Ideas ?

cheers.

Tags (1)
0 Karma

somesoni2
Revered Legend

The span attribute works on the column preceding it. Does the u_short_description field contains timestamp in epoch format? If the u_real_hit_time field contains timestamp, then you need to move span just after that in chart command.

| dbxquery query="SELECT some select statement
| eval u_total_time=u_total_time/1000 
| chart avg(u_total_time) over u_real_hit_time span=1m by u_short_description 

See this for example
http://docs.splunk.com/Documentation/Splunk/6.5.3/SearchReference/Chart#6:_Chart_the_number_of_event...

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...