Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Incorrect message: minspan option has no effec...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Incorrect message: minspan option has no effect when span is specified
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
According to Support this is bug SPL-59079 and will be fixed in 5.0.3.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I tested and despite the message saying it has no effect, it certainly does have an effect: ... | timechart minspan=30s count by ... makes 30 second buckets on a Last 15 Minutes search. However, ... | timechart minspan=5s count by ... makes 10-second buckets. Case 114952 filed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Also on Splunk 5.0.2, just in flashtimeline or charting views. "Span" is likely a time range you're running the search over - the message would not pop up or all time searches or real time searches - but any other timespan had this message appear. http://[splunk instance]/en-US/app/search/charting/?q=search%20index%3D_internal%20|%20timechart%20minspan%3D30s%20count%20by%20sourcetype&earliest=-24h%40h&latest=now&c.chart=area&c.title=&c.stack=stacked&c.split=false&c.nulls=zero&c.legend=right&c.x.title=&c.y.title=&c.y.min=&c.y.max=&c.y.scale=
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Seeing the same thing in 2.3.1 on Splunk 5.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
FWIW, I'm seeing this error while running reports in SoS v2.3.1 on Splunk 5.0 as well.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
