Splunk Search

How to build time charts using Hunk?

wonderz44
Engager

I have read about the limitations on using Hunk (http://docs.splunk.com/Documentation/Hunk/6.2.3/Hunk/Searchavirtualindex#How_Hunk_reporting_uses_sea...)

but is there a way to set up time charts and bucket by time in Hunk?

My Hunk queries work fine on the virtual index when I run them in search but adding them to dashboard, all search results are combined into a single out of range, one hour bucket.

0 Karma
1 Solution

Ledion_Bitincka
Splunk Employee
Splunk Employee

You're probably running into an issue related to with time stamp extraction and field projection (only picking the required field) - for more info see this thread

The fix for this would be tell Hunk to always output the field(s) from which the timestamp is extracted, for example

 [vix]
....
vix.input.1.required.fields = Date

View solution in original post

Ledion_Bitincka
Splunk Employee
Splunk Employee

You're probably running into an issue related to with time stamp extraction and field projection (only picking the required field) - for more info see this thread

The fix for this would be tell Hunk to always output the field(s) from which the timestamp is extracted, for example

 [vix]
....
vix.input.1.required.fields = Date

Ledion_Bitincka
Splunk Employee
Splunk Employee

Can you elaborate on what you mean by "My Hunk queries work fine on the virtual index when I run them in search "? Is timestamp extracted correctly when you run a simple search like "index=vix | head 10", but not when using timechart? Also, what data format are you working with?

0 Karma

wonderz44
Engager

I am working with .csv syslog file stored on Hadoop.

I have setup a virtual index for the file.

When I try the queries in search app and Verbose mode, I get the correct result. But the dashboard runs in either fast or smart mode (can't verify which one) so instead of picking the correct time stamp, it picks the last touch time of the file on Hadoop.

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...