Splunk Search

Real time window not working with timechart

marvinlee93
Explorer

| eval _time=_time+28800 |timechart values(Acc_X_G) as Acc_X values(Acc_Y_G) as Acc_Y values(Acc_Z_G) as Acc_Z

Above is my search code for my timechart. I have set the Auto Refresh Delay to 1s.
However, the timechart only works with All time(real-time) but it fails with the other real time windows. (30s, 1min, 5min, 30min & 1hr)
Also, my data has been time stamped correctly.

Any idea what's the problem here?

Tags (1)
0 Karma

woodcock
Esteemed Legend

You actually do have severe timestamping problems. I suggest that you install the Meta Woot! (https://splunkbase.splunk.com/app/2949/) and Data Curator (https://splunkbase.splunk.com/app/1848/) apps and go through the screens and fix your timestamping problems. You can hear a bit more about why these are important in my .conf talk here:

https://conf.splunk.com/files/2018/recordings/10-must-have-apps-fn1072.mp4

0 Karma

woodcock
Esteemed Legend

If your time is timestamped correctly, then you would not need to do | eval _time = _time+28800.

0 Karma

marvinlee93
Explorer

Hi! Thanks for the quick reply! I have added this line because the x-axis(time) on my timechart is lagging by 8 hours. Didn't know that it will affect my real-time search! Is there a way to solve this issue without affecting my real time search window?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...