Splunk Search

Incorrect message: minspan option has no effect when span is specified

Path Finder

In splunk 5.0.1 adding "minspan" to timechart results in the message "minspan option has no effect when span is specified". The span has not be been specified.

index=INDEX TOKEN | timechart minspan=10m max(MILLISECS) by GROUP_ID

Tags (4)
0 Karma

Motivator

According to Support this is bug SPL-59079 and will be fixed in 5.0.3.

Motivator

I tested and despite the message saying it has no effect, it certainly does have an effect: ... | timechart minspan=30s count by ... makes 30 second buckets on a Last 15 Minutes search. However, ... | timechart minspan=5s count by ... makes 10-second buckets. Case 114952 filed.

0 Karma

Motivator

Also on Splunk 5.0.2, just in flashtimeline or charting views. "Span" is likely a time range you're running the search over - the message would not pop up or all time searches or real time searches - but any other timespan had this message appear. http://[splunk instance]/en-US/app/search/charting/?q=search%20index%3D_internal%20|%20timechart%20minspan%3D30s%20count%20by%20sourcetype&earliest=-24h%40h&latest=now&c.chart=area&c.title=&c.stack=stacked&c.split=false&c.nulls=zero&c.legend=right&c.x.title=&c.y.title=&c.y.min=&c.y.max=&c.y.scale=

0 Karma

Contributor

Seeing the same thing in 2.3.1 on Splunk 5.

0 Karma

Explorer

FWIW, I'm seeing this error while running reports in SoS v2.3.1 on Splunk 5.0 as well.

0 Karma