Splunk Enterprise

Snap-to-time in timechart

rsuryasaputra1
New Member

Hello

I'm confused about this behaviour... the search works if the span is just weekly; but fails when putting w1.

| timechart span=w@w1 dc(serial)

returns with error
Streamed search execute failed because: Error in 'bin' command: The value for option span (w@w1) is invalid. When span is expressed using a sub-second unit (ds, cs, ms, us), the span value needs to be < 1 second, and 1 second must be evenly divisible by the span value.

Splunk Enterprise 6.6.3.

Thank you in advanced for your help and insights!

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The searches you posted as broken are working for me. Have you considered upgrading, just in case 6.6.3 might have a bug around this feature? It was new for 6.6.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Do post your entire search.

0 Karma

rsuryasaputra1
New Member

Thanks for your responses so far. I'm querying summarised index here.

index="tv" sourcetype="stash" group="voice_analytics" source="voice_googleid_linked" | timechart span=1w dc(serial) as "# of TVs linked" <== works, last 30 days (i.e. from 20-Oct) buckets to weeks starting from Saturday.

index="tv" sourcetype="stash" group="voice_analytics" source="voice_googleid_linked" | timechart span=1w@w dc(serial) as "# of TVs linked" <== Streamed search execute failed because: Error in 'bin' command: The value for option span (1w@w) is invalid. When span is expressed using a sub-second unit (ds, cs, ms, us), the span value needs to be < 1 second, and 1 second must be evenly divisible by the span value.

index="tv" sourcetype="stash" group="voice_analytics" source="voice_googleid_linked" | timechart span=1w@w3 dc(serial) as "# of TVs linked" <== Streamed search execute failed because: Error in 'bin' command: The value for option span (1w@w3) is invalid. When span is expressed using a sub-second unit (ds, cs, ms, us), the span value needs to be < 1 second, and 1 second must be evenly divisible by the span value.

0 Karma

echalex
Builder

The error message is misleading, in my view. I tried this in Splunk 6.5.9 and received the same error message. However, the difference is that Splunk 6.5.9 doesn't have the snap-to as a feature for timechart, but according to the doc 6.6.3, should have it.

(Original answer converted to a comment and edited entirely. I assumed that 1w@w would be the correct snap-to in 6.6.3, but I was corrected.)

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

@w1 is correct, snapping to Monday.

The integer before the time unit is optional, and documented as such by being in square brackets.

0 Karma

echalex
Builder

Right... I didn't check so far in the documentation and it's a new construct/feature to me.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Works fine in my Splunk, but I'm on 7.2

0 Karma

HiroshiSatoh
Champion

7.0.3 and 6.6.1 worked.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...