How to correct timechart after upgrading

[Jaylon]

timechart [stats count | eval range="$timeRange$" | eval search=case(range=="-6h", "span=30m ", range=="-1d", "span=1h ", range=="-3d", "span=2h ", range=="-7d", "span=4h ")] can't work after upgrade splunk from 8.0.6 to 8.2.5.

[ITWhisperer]

It looks like you are trying to set the span based on the value of a token. Why not create a additional token at the same time as the timeRange token based on the options you want?

<eval token="span">case($timeRange$=="-6h", "span=30m ", $timeRange$=="-1d", "span=1h ", $timeRange$=="-3d", "span=2h ", $timeRange$=="-7d", "span=4h ")</eval>

timechart $span$

[VatsalJagani]

@Jaylon  - Try something like the below as suggested by @PickleRick 

timechart [| makeresults | eval range="$timeRange$" | eval search=case(range=="-6h", "span=30m ", range=="-1d", "span=1h ", range=="-3d", "span=2h ", range=="-7d", "span=4h ")]

[PickleRick]

Regardless of update I don't see this search working properly unles you were very very lucky so far.

The subsearch starts with "stats count". Since you don't specify any command, it's treated as arguments for the implicit search command. So you're searching for the events containing  both words "stats" and "count" in your user's default index using time picker's timerange. It's probably not what you wanted.

You might want to start your search with "| makeresults" instead of this search.