Splunk Search

How to correct timechart after upgrading

Loves-to-Learn Lots

timechart [stats count | eval range="$timeRange$" | eval search=case(range=="-6h", "span=30m ", range=="-1d", "span=1h ", range=="-3d", "span=2h ", range=="-7d", "span=4h ")] can't work after upgrade splunk from 8.0.6 to 8.2.5.

Labels (3)
0 Karma


It looks like you are trying to set the span based on the value of a token. Why not create a additional token at the same time as the timeRange token based on the options you want?

<eval token="span">case($timeRange$=="-6h", "span=30m ", $timeRange$=="-1d", "span=1h ", $timeRange$=="-3d", "span=2h ", $timeRange$=="-7d", "span=4h ")</eval>

timechart $span$


@Jaylon  - Try something like the below as suggested by @PickleRick 

timechart [| makeresults | eval range="$timeRange$" | eval search=case(range=="-6h", "span=30m ", range=="-1d", "span=1h ", range=="-3d", "span=2h ", range=="-7d", "span=4h ")]


0 Karma

Ultra Champion

Regardless of update I don't see this search working properly unles you were very very lucky so far.

The subsearch starts with "stats count". Since you don't specify any command, it's treated as arguments for the implicit search command. So you're searching for the events containing  both words "stats" and "count" in your user's default index using time picker's timerange. It's probably not what you wanted.

You might want to start your search with "| makeresults" instead of this search.

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...