Splunk Search

Real time window not working with timechart

marvinlee93
Explorer

| eval _time=_time+28800 |timechart values(Acc_X_G) as Acc_X values(Acc_Y_G) as Acc_Y values(Acc_Z_G) as Acc_Z

Above is my search code for my timechart. I have set the Auto Refresh Delay to 1s.
However, the timechart only works with All time(real-time) but it fails with the other real time windows. (30s, 1min, 5min, 30min & 1hr)
Also, my data has been time stamped correctly.

Any idea what's the problem here?

Tags (1)
0 Karma

woodcock
Esteemed Legend

You actually do have severe timestamping problems. I suggest that you install the Meta Woot! (https://splunkbase.splunk.com/app/2949/) and Data Curator (https://splunkbase.splunk.com/app/1848/) apps and go through the screens and fix your timestamping problems. You can hear a bit more about why these are important in my .conf talk here:

https://conf.splunk.com/files/2018/recordings/10-must-have-apps-fn1072.mp4

0 Karma

woodcock
Esteemed Legend

If your time is timestamped correctly, then you would not need to do | eval _time = _time+28800.

0 Karma

marvinlee93
Explorer

Hi! Thanks for the quick reply! I have added this line because the x-axis(time) on my timechart is lagging by 8 hours. Didn't know that it will affect my real-time search! Is there a way to solve this issue without affecting my real time search window?

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>