Real time window not working with timechart

[marvinlee93]

| eval _time=_time+28800 |timechart values(Acc_X_G) as Acc_X values(Acc_Y_G) as Acc_Y values(Acc_Z_G) as Acc_Z

Above is my search code for my timechart. I have set the Auto Refresh Delay to 1s.
However, the timechart only works with All time(real-time) but it fails with the other real time windows. (30s, 1min, 5min, 30min & 1hr)
Also, my data has been time stamped correctly.

Any idea what's the problem here?

[woodcock]

You actually do have severe timestamping problems. I suggest that you install the Meta Woot! (https://splunkbase.splunk.com/app/2949/) and Data Curator (https://splunkbase.splunk.com/app/1848/) apps and go through the screens and fix your timestamping problems. You can hear a bit more about why these are important in my .conf talk here:

https://conf.splunk.com/files/2018/recordings/10-must-have-apps-fn1072.mp4

[woodcock]

If your time is timestamped correctly, then you would not need to do | eval _time = _time+28800.

[marvinlee93]

Hi! Thanks for the quick reply! I have added this line because the x-axis(time) on my timechart is lagging by 8 hours. Didn't know that it will affect my real-time search! Is there a way to solve this issue without affecting my real time search window?