Splunk Search

How does 'partial=True' affects 'timechart' results?

abonuccelli_spl
Splunk Employee
Splunk Employee

I am grouping time buckets using 'span' and I'd like to trim partial time buckets at the beginning and end of the search of the time line as they're not representative of a full span period

Tags (2)
1 Solution

abonuccelli_spl
Splunk Employee
Splunk Employee

Below the difference in how results are presented (or omitted)

partial=False

user@workstation-486-DX2-66 /opt/splunk/bin $ ./splunk search "sourcetype=psql-lab-dbx_feeder_tsb_7848 earliest=-20m@m | timechart span=5m count partial=False"
INFO: Your timerange was substituted based on your search string
           _time            count
--------------------------- -----
2014-07-01 09:15:00.000 BST   310
2014-07-01 09:20:00.000 BST   546
2014-07-01 09:25:00.000 BST   577

partial=True

user@workstation-486-DX2-66 /opt/splunk/bin $ ./splunk search "sourcetype=psql-lab-dbx_feeder_tsb_7848 earliest=-20m@m | timechart span=5m count partial=True"
INFO: Your timerange was substituted based on your search string
           _time            count
--------------------------- -----
2014-07-01 09:10:00.000 BST     0
2014-07-01 09:15:00.000 BST   310
2014-07-01 09:20:00.000 BST   546
2014-07-01 09:25:00.000 BST   577
2014-07-01 09:30:00.000 BST   533

View solution in original post

abonuccelli_spl
Splunk Employee
Splunk Employee

Below the difference in how results are presented (or omitted)

partial=False

user@workstation-486-DX2-66 /opt/splunk/bin $ ./splunk search "sourcetype=psql-lab-dbx_feeder_tsb_7848 earliest=-20m@m | timechart span=5m count partial=False"
INFO: Your timerange was substituted based on your search string
           _time            count
--------------------------- -----
2014-07-01 09:15:00.000 BST   310
2014-07-01 09:20:00.000 BST   546
2014-07-01 09:25:00.000 BST   577

partial=True

user@workstation-486-DX2-66 /opt/splunk/bin $ ./splunk search "sourcetype=psql-lab-dbx_feeder_tsb_7848 earliest=-20m@m | timechart span=5m count partial=True"
INFO: Your timerange was substituted based on your search string
           _time            count
--------------------------- -----
2014-07-01 09:10:00.000 BST     0
2014-07-01 09:15:00.000 BST   310
2014-07-01 09:20:00.000 BST   546
2014-07-01 09:25:00.000 BST   577
2014-07-01 09:30:00.000 BST   533

andreyminakov
Explorer

It doesn't work in my case...

0 Karma

andreyminakov
Explorer

I understood the principle of "partial" working exactly as maciep, and I don't see anything opposite in documentation. The only suspicious thing is that it is said in the documentation that «Only the first and last bin can be partial.». As far as I understand, the first and the last bins have always be consider as partial. Otherwise the system has to have some logic to understand where the first or/and last bins are partial or not. And IMHO this is impossible, because the software cannot understand whether e.g. the first period is incomplete, or there just really weren’t any events during the first part of this first bean.

The same issue is here:
https://answers.splunk.com/answers/432520/why-is-timechart-partialfalse-still-returning-part.html
https://answers.splunk.com/answers/418447/how-is-the-partial-flag-supposed-to-work-with-time.html

So it would be great to solve that issue.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...