help on X axis date truncated with a scheduled search

[jip31]

Hello

I have an issue on the X axis of my timechart

As you can see in my xml file, I use a scheduled search in order to display the timechart on the last 30 days

But considering that today it's the 3 of March, Splunk display the data between the 3 of February and the 3 of March. It's not a problem for me but the real problem is that on my X axis I have the 1 of Februray and the 2 of February empty because in this case Splunk calculate 30 days considering there is just 28 days in February (please see my screenshot)

So, what is the solution :

1) for displaying a line chart on a 30 days period (so between the 1 of February and the 2 of March)

2) Or to avoid to habe the 1 of February and the 2 of February displayed considering that Splunk display the line chart between the 3 of February and the 3 of March

Thanks

 <query>| loadjob savedsearch="admin:SA_WXCV_sh:Performances - Boot trend" 
| timechart span=1d eval(round(avg(BootTime)/1000,0)) as "Boot time" 
| eventstats avg("Boot time") as Average 
| eval Average=round(Average,0)</query>
          <earliest>-30d@d</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
        <option name="charting.axisTitleX.text">Date</option>
        <option name="charting.axisTitleY.text">Boot time (Average in seconds)</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.fontColor">#000000</option>
        <option name="height">400</option>
        <option name="refresh.display">progressbar</option>
        <option name="charting.chart.overlayFields">Average</option>
        <option name="charting.fieldColors">{"Boot time": 0x639BF1, "Average":0xFF5A09}</option>
        <option name="charting.fieldDashStyles">{"Boot time":"solid"}</option>
        <option name="charting.lineWidth">4px</option>
      </chart>

Screenshot

https://www.cjoint.com/c/KCdgGtebT5h

[jip31]

Is anybody can help please?

[ITWhisperer]

Does the data exist in your saved report or is only 3rd Feb to 3rd Mar being returned?

[jip31]

data exists for average field for 1 and 2 of February but not for boot time field

[ITWhisperer]

Can you fix the saved search so that the missing boot time data is returned?

[jip31]

I dont know how to do it, reason why I posted this question....

When I execute the search directly in my dashboard, I have data on the last 30 days (1 February to 3 March)

But when I use the saved search I have only data between 3 February and 3 March