Splunk Search

How does 'partial=True' affects 'timechart' results?

abonuccelli_spl
Splunk Employee
Splunk Employee

I am grouping time buckets using 'span' and I'd like to trim partial time buckets at the beginning and end of the search of the time line as they're not representative of a full span period

Tags (2)
1 Solution

abonuccelli_spl
Splunk Employee
Splunk Employee

Below the difference in how results are presented (or omitted)

partial=False

user@workstation-486-DX2-66 /opt/splunk/bin $ ./splunk search "sourcetype=psql-lab-dbx_feeder_tsb_7848 earliest=-20m@m | timechart span=5m count partial=False"
INFO: Your timerange was substituted based on your search string
           _time            count
--------------------------- -----
2014-07-01 09:15:00.000 BST   310
2014-07-01 09:20:00.000 BST   546
2014-07-01 09:25:00.000 BST   577

partial=True

user@workstation-486-DX2-66 /opt/splunk/bin $ ./splunk search "sourcetype=psql-lab-dbx_feeder_tsb_7848 earliest=-20m@m | timechart span=5m count partial=True"
INFO: Your timerange was substituted based on your search string
           _time            count
--------------------------- -----
2014-07-01 09:10:00.000 BST     0
2014-07-01 09:15:00.000 BST   310
2014-07-01 09:20:00.000 BST   546
2014-07-01 09:25:00.000 BST   577
2014-07-01 09:30:00.000 BST   533

View solution in original post

abonuccelli_spl
Splunk Employee
Splunk Employee

Below the difference in how results are presented (or omitted)

partial=False

user@workstation-486-DX2-66 /opt/splunk/bin $ ./splunk search "sourcetype=psql-lab-dbx_feeder_tsb_7848 earliest=-20m@m | timechart span=5m count partial=False"
INFO: Your timerange was substituted based on your search string
           _time            count
--------------------------- -----
2014-07-01 09:15:00.000 BST   310
2014-07-01 09:20:00.000 BST   546
2014-07-01 09:25:00.000 BST   577

partial=True

user@workstation-486-DX2-66 /opt/splunk/bin $ ./splunk search "sourcetype=psql-lab-dbx_feeder_tsb_7848 earliest=-20m@m | timechart span=5m count partial=True"
INFO: Your timerange was substituted based on your search string
           _time            count
--------------------------- -----
2014-07-01 09:10:00.000 BST     0
2014-07-01 09:15:00.000 BST   310
2014-07-01 09:20:00.000 BST   546
2014-07-01 09:25:00.000 BST   577
2014-07-01 09:30:00.000 BST   533

andreyminakov
Explorer

It doesn't work in my case...

0 Karma

andreyminakov
Explorer

I understood the principle of "partial" working exactly as maciep, and I don't see anything opposite in documentation. The only suspicious thing is that it is said in the documentation that «Only the first and last bin can be partial.». As far as I understand, the first and the last bins have always be consider as partial. Otherwise the system has to have some logic to understand where the first or/and last bins are partial or not. And IMHO this is impossible, because the software cannot understand whether e.g. the first period is incomplete, or there just really weren’t any events during the first part of this first bean.

The same issue is here:
https://answers.splunk.com/answers/432520/why-is-timechart-partialfalse-still-returning-part.html
https://answers.splunk.com/answers/418447/how-is-the-partial-flag-supposed-to-work-with-time.html

So it would be great to solve that issue.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...