Splunk Search

Incorrect message: minspan option has no effect when span is specified

unclethan
Path Finder

In splunk 5.0.1 adding "minspan" to timechart results in the message "minspan option has no effect when span is specified". The span has not be been specified.

index=INDEX TOKEN | timechart minspan=10m max(MILLISECS) by GROUP_ID

Tags (4)
0 Karma

Jason
Motivator

According to Support this is bug SPL-59079 and will be fixed in 5.0.3.

Jason
Motivator

I tested and despite the message saying it has no effect, it certainly does have an effect: ... | timechart minspan=30s count by ... makes 30 second buckets on a Last 15 Minutes search. However, ... | timechart minspan=5s count by ... makes 10-second buckets. Case 114952 filed.

0 Karma

Jason
Motivator

Also on Splunk 5.0.2, just in flashtimeline or charting views. "Span" is likely a time range you're running the search over - the message would not pop up or all time searches or real time searches - but any other timespan had this message appear. http://[splunk instance]/en-US/app/search/charting/?q=search%20index%3D_internal%20|%20timechart%20minspan%3D30s%20count%20by%20sourcetype&earliest=-24h%40h&latest=now&c.chart=area&c.title=&c.stack=stacked&c.split=false&c.nulls=zero&c.legend=right&c.x.title=&c.y.title=&c.y.min=&c.y.max=&c.y.scale=

0 Karma

tmeader
Contributor

Seeing the same thing in 2.3.1 on Splunk 5.

0 Karma

lsnow
Explorer

FWIW, I'm seeing this error while running reports in SoS v2.3.1 on Splunk 5.0 as well.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...