Splunk Search

Gap in chart data

Ant1D
Motivator

Hi,

I have a chart that is produced by executing a search with a | timechart command.

As the search is executing, you can see the chart cells appear as shown in the following image:
alt text

But once the search above is finished the following gap appears in the chart data:
alt text

This search has just over 150000 matching events in total. Is this gap appearing because a search limit is being exceeded? How can I stop this from happening?

Help would be much appreciated. Thanks in advance.

0 Karma
1 Solution

fox
Path Finder

This can be resolved by restructuring the search. Simply add a stats command stage to help the timechart command on it's way. It fixes the issue.

View solution in original post

0 Karma

fox
Path Finder

This can be resolved by restructuring the search. Simply add a stats command stage to help the timechart command on it's way. It fixes the issue.

0 Karma

sloshburch
Ultra Champion

Are you proposing using both stats and timechart?

For example a search like this is showing gaps for me as well (but searches with smaller time windows show the data does exist and can be generated by timechart)
_some_base_search | timechart span=1d perc90(field)

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...