Splunk Search

Gap in chart data

Ant1D
Motivator

Hi,

I have a chart that is produced by executing a search with a | timechart command.

As the search is executing, you can see the chart cells appear as shown in the following image:
alt text

But once the search above is finished the following gap appears in the chart data:
alt text

This search has just over 150000 matching events in total. Is this gap appearing because a search limit is being exceeded? How can I stop this from happening?

Help would be much appreciated. Thanks in advance.

0 Karma
1 Solution

fox
Path Finder

This can be resolved by restructuring the search. Simply add a stats command stage to help the timechart command on it's way. It fixes the issue.

View solution in original post

0 Karma

fox
Path Finder

This can be resolved by restructuring the search. Simply add a stats command stage to help the timechart command on it's way. It fixes the issue.

0 Karma

sloshburch
Ultra Champion

Are you proposing using both stats and timechart?

For example a search like this is showing gaps for me as well (but searches with smaller time windows show the data does exist and can be generated by timechart)
_some_base_search | timechart span=1d perc90(field)

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0

    Are you ready to transform how your team handles complex data requests? We invite you to our upcoming ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...