Not getting by day results for a timechart

[di2esysadmin]

I'm banging my head against the wall. Here's my search:

host="atlassian-stash*" sourcetype=atlassian source="/opt/atlassian/stash-data/log/atlassian-stash-access*.log" | timechart dc(stash_users) span=1d AS "Unique Stash Users"

stash_users is an extracted field. Pretty clear from search results that it's working correctly.

When I run the above, I get 8 results (as though it thinks it's giving me by day results) the only days with values are 2/18 and 2/11. As though it's counting unique stash_users by week.

I have this precise format working with a different extracted field on a different file. Hence the head banging.

Help appreciated.

Karla

[di2esysadmin · Accepted solution]

That's it! The problem is my field extraction. It was based on a filename. The entries for the others days came from log files with a different named format.

Thanks for the ideas!

[di2esysadmin]

There has to be a problem with the way I've extracted the field. It's too simple for it to be anything else.

[di2esysadmin]

No change in behavior. 😞

[yannK]

Just for sanity,

change the order of your timechart to avoid having the span between the function and the "AS"
| timechart span=1d dc(stash_users) AS "Unique Stash Users"

[linu1988]

what do u get by host="atlassian-stash"

sourcetype=atlassian source="/opt/atlassian/stash-data/log/atlassian-stash-access.log"|bucket _time span=1d| stats dc(stash_users) by _time?

[di2esysadmin]

Didn't fix it. Here's my query now:

host="atlassian-stash*" sourcetype=atlassian source="/opt/atlassian/stash-data/log/atlassian-stash-access*.log" | timechart span=1d dc(stash_users) AS "Unique Stash Users"

[yannK]

good, @di2esysadmin please accept the answer to mark it as resolved.

[linu1988]

This is it 😄

[linu1988]

What do you get if you just make a |bucket _time span=1d| stats dc(stash_users) by _time instead of timechart?