Splunk Search

How to fix weird futuristic time range in timechart with tstats?

yuanliu
SplunkTrust
SplunkTrust

Consider these three searches that end with timechart.  The second one skews time range all the way to year 2038!  How do I fix that?

1. Index search

timechart-index.png

2. Change to equivalent tstats

 

| tstats count where index=_internal earliest=-7d by _time span=1d
| timechart span=1d sum(count)

 

timechart-tstats.png

Note how timespan magically changes all the way to 2038?

3. Do not use earliest with tstats; use time selector in search screen.

 

| tstats count where index=_internal ```earliest=-7d``` by _time span=1d
| timechart span=1d sum(count)

 

timechart-tstats-no-earliest.png

I have specific reasons to set earliest with specific token in dashboard.  So, search time selector is not an option.

Labels (2)
Tags (1)
0 Karma
1 Solution

tcottreau
Explorer

surely, latest=now would solve your problem?

View solution in original post

tcottreau
Explorer

surely, latest=now would solve your problem?

yuanliu
SplunkTrust
SplunkTrust

Guess I panicked😀.  Yes, latest fixed it.  But the behavior is still very bizarre.  To be sure

| tstats count where index=_internal earliest=-7d by _time span=1d

only outputs 8 rows, not thousands.  Why would timechart interact with it weirdly? 

0 Karma

tcottreau
Explorer

Agreed that it is unusual.

I have had similar behaviour in some of my timecharts when I specify my time. I haven't looked into it enough to figure it out.

Where future isn't specified, I can at least see it (reluctantly, but with previous data (with start time and end times specified in the time selector), I can't explain it. Example below:

As you can see, I have specified an hour 1 week ago, but for some reason, the timechart insists that latest=now... it's a bug, I'm pretty sure.

tcottreau_0-1690855498915.png

 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...