Splunk Search

Incorrect message: minspan option has no effect when span is specified

unclethan
Path Finder

In splunk 5.0.1 adding "minspan" to timechart results in the message "minspan option has no effect when span is specified". The span has not be been specified.

index=INDEX TOKEN | timechart minspan=10m max(MILLISECS) by GROUP_ID

Tags (4)
0 Karma

Jason
Motivator

According to Support this is bug SPL-59079 and will be fixed in 5.0.3.

Jason
Motivator

I tested and despite the message saying it has no effect, it certainly does have an effect: ... | timechart minspan=30s count by ... makes 30 second buckets on a Last 15 Minutes search. However, ... | timechart minspan=5s count by ... makes 10-second buckets. Case 114952 filed.

0 Karma

Jason
Motivator

Also on Splunk 5.0.2, just in flashtimeline or charting views. "Span" is likely a time range you're running the search over - the message would not pop up or all time searches or real time searches - but any other timespan had this message appear. http://[splunk instance]/en-US/app/search/charting/?q=search%20index%3D_internal%20|%20timechart%20minspan%3D30s%20count%20by%20sourcetype&earliest=-24h%40h&latest=now&c.chart=area&c.title=&c.stack=stacked&c.split=false&c.nulls=zero&c.legend=right&c.x.title=&c.y.title=&c.y.min=&c.y.max=&c.y.scale=

0 Karma

tmeader
Contributor

Seeing the same thing in 2.3.1 on Splunk 5.

0 Karma

lsnow
Explorer

FWIW, I'm seeing this error while running reports in SoS v2.3.1 on Splunk 5.0 as well.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...