In Splunk versions after 6.4.3, chart using span=log no longer works. Is there a workaround?

[rdominy]

I was successfully using the following query with Splunk 6.4.3:

index="pixelscoredata"| chart count by imps_budget bins=10 span=log

But as of 6.4.4 and 6.5.0 it now throws the following error:

"Error in 'chart' command: The value for option span is invalid: 'log'. "

This still works fine if using timechart instead of chart. I've tried a number of variations such as specifying the coefficient and base without success. The documentation shows it still being supported.

Is this a known bug? Any workarounds?

[rdominy · Accepted solution]

We found the problem. We had a file import with source type set to automatic and it ended up creating over 80K rows of new types and was severely slowing down the system. That appears to have been causing some under-the-covers timeout in searches on other indexes because as soon as we cleaned that up, span=log began working.

TL;DR If features stop working (even coincidently after a software upgrade), check your imports and source types and avoid "automatic" source types.

[cmerriman]

I shortened the timeframe and got it to work, but when I'm looking for a longer period of time, it works for a few seconds and errors out.