Splunk Enterprise

help on basic question about span in timechart

jip31
Motivator

hello

I use a one hour span in my timechart but I dont understand why a two hour span is displayed on the timechart abscissa instead one hour?

| timechart span=1h max(debut) as "Début de session", max(fin) as "Fin de session"

thanks

 

 

Labels (1)
Tags (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

The only situation that timechart seems to be doing strange things is when _time is outside of your search range. For example:

| makeresults count=10 
| streamstats count
| eval _time=_time+7200*count
| timechart span=1h count

 It indeed aligns the results to the full hours for which there is data.

If you run this search with any "past" time range chosen from the time picker, it will give you results spread over 2-hour span. If you chose "any time" however, you'll get proper 1-hour spans with alternating 0 and 1 values.

It looks like a bug.

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

Hmm, it's hard to believe since it's span's function to define the... span size.

Can you show us the results of:

<<your_search_with_timechart>> 
| autoregress _time as oldtime
| eval diff=_time-oldtime
| stats count by diff

 

0 Karma

jip31
Motivator

count is 11 and diff 7200

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

The only situation that timechart seems to be doing strange things is when _time is outside of your search range. For example:

| makeresults count=10 
| streamstats count
| eval _time=_time+7200*count
| timechart span=1h count

 It indeed aligns the results to the full hours for which there is data.

If you run this search with any "past" time range chosen from the time picker, it will give you results spread over 2-hour span. If you chose "any time" however, you'll get proper 1-hour spans with alternating 0 and 1 values.

It looks like a bug.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...