Snap-to-time in timechart

[rsuryasaputra1]

Hello

I'm confused about this behaviour... the search works if the span is just weekly; but fails when putting w1.

| timechart span=w@w1 dc(serial)

returns with error
Streamed search execute failed because: Error in 'bin' command: The value for option span (w@w1) is invalid. When span is expressed using a sub-second unit (ds, cs, ms, us), the span value needs to be < 1 second, and 1 second must be evenly divisible by the span value.

Splunk Enterprise 6.6.3.

Thank you in advanced for your help and insights!

[martin_mueller]

The searches you posted as broken are working for me. Have you considered upgrading, just in case 6.6.3 might have a bug around this feature? It was new for 6.6.

[martin_mueller]

Do post your entire search.

[rsuryasaputra1]

Thanks for your responses so far. I'm querying summarised index here.

index="tv" sourcetype="stash" group="voice_analytics" source="voice_googleid_linked" | timechart span=1w dc(serial) as "# of TVs linked" <== works, last 30 days (i.e. from 20-Oct) buckets to weeks starting from Saturday.

index="tv" sourcetype="stash" group="voice_analytics" source="voice_googleid_linked" | timechart span=1w@w dc(serial) as "# of TVs linked" <== Streamed search execute failed because: Error in 'bin' command: The value for option span (1w@w) is invalid. When span is expressed using a sub-second unit (ds, cs, ms, us), the span value needs to be < 1 second, and 1 second must be evenly divisible by the span value.

index="tv" sourcetype="stash" group="voice_analytics" source="voice_googleid_linked" | timechart span=1w@w3 dc(serial) as "# of TVs linked" <== Streamed search execute failed because: Error in 'bin' command: The value for option span (1w@w3) is invalid. When span is expressed using a sub-second unit (ds, cs, ms, us), the span value needs to be < 1 second, and 1 second must be evenly divisible by the span value.

[echalex]

The error message is misleading, in my view. I tried this in Splunk 6.5.9 and received the same error message. However, the difference is that Splunk 6.5.9 doesn't have the snap-to as a feature for timechart, but according to the doc 6.6.3, should have it.

(Original answer converted to a comment and edited entirely. I assumed that 1w@w would be the correct snap-to in 6.6.3, but I was corrected.)

[martin_mueller]

@w1 is correct, snapping to Monday.

The integer before the time unit is optional, and documented as such by being in square brackets.

[echalex]

Right... I didn't check so far in the documentation and it's a new construct/feature to me.

[martin_mueller]

Works fine in my Splunk, but I'm on 7.2

[HiroshiSatoh]

7.0.3 and 6.6.1 worked.