Splunk Search

Inexplicable extra chart data point?

arichman
Explorer

I have multiple searches over a year's date range, similar to:
base search | timechart span=1month dc(foo)

and they are all reproducing the same strange statistics, and in turn visualization...

all of the data is grouped by month, but the very last month is repeated twice, time stamps 7 hours apart, and the values for the first of those points being incomplete
_time count
2013-12-01 00:00 100
2013-12-01 08:00 200
2014-01-01 08:00 300
2014-02-01 08:00 400
2014-03-01 08:00 500
2014-04-01 07:00 600
2014-05-01 07:00 700
2014-06-01 07:00 800
2014-07-01 07:00 900
2014-08-01 07:00 1000
2014-09-01 07:00 1100
2014-10-01 07:00 1200
2014-11-01 00:00 250
2014-11-01 07:00 1300

Is this expected behavior? If so, I would greatly appreciate any assistance with cleaning it up!

Thanks very much

Tags (2)
0 Karma
1 Solution

musskopf
Builder

I believe this is the behavior for the partial=true, which is the default. From the timechart documentation:

partial
Syntax: partial=
Description: Controls if partial time buckets should be retained or not. Only the first and last bucket could ever be partial. Defaults to True|T, meaning that they are retained.

Try to use:

base search | timechart partial=f span=1month dc(foo) 

or

base search | bucket span=1mon _time | timechart span=1month dc(foo) 

View solution in original post

0 Karma

musskopf
Builder

I believe this is the behavior for the partial=true, which is the default. From the timechart documentation:

partial
Syntax: partial=
Description: Controls if partial time buckets should be retained or not. Only the first and last bucket could ever be partial. Defaults to True|T, meaning that they are retained.

Try to use:

base search | timechart partial=f span=1month dc(foo) 

or

base search | bucket span=1mon _time | timechart span=1month dc(foo) 
0 Karma

arichman
Explorer

That appears to do the trick. Thank you!

0 Karma

arichman
Explorer

Specifically, the second example worked for me.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...