Splunk Search

The automatic timechart range changed after upgrading from Splunk 6.3.1 to 6.3.3. What can we set to revert to the old behavior?

johnraftery
Communicator

We have certain source types where there is only data from months ago. When putting this into a timechart, the chart was smart enough to see that it didn't need to display months of nothing, so the earliest and latest end of the chart were set to the earliest and latest times of the data. That was in 6.3.1. We've just upgraded to 6.3.3, and this is no longer working. Now, the chart shows everything from the start of the data until now, which is not useful at all. Is there a flag or something that we can set to revert to the old behavior?

Many thanks,
John Raftery

0 Karma

jeffland
Champion

Have you had a look at the fixedrange argument for timechart? The description sounds interesting:

Specify whether or not to enforce the earliest and latest times of the search. Setting fixedrange=false allows the timechart command to constrict to just the time range with valid data. 
0 Karma

johnraftery
Communicator

Thanks for pointing me towards fixedrange - this seems related to what I need. In the end though it just puts all of my data into one bin. This is my query:
eventtype=mlc sourcetype=vmstat-linux host=DBS_TEST_engine_profiler4 | timechart fixedrange=false bins=100 avg(cpu_used) by source
Interestingly, if I change bins=100 into span=1m, it produces what I want. However, I can't use span=1m because often there would be too many points to display - when the time range is too long.

0 Karma

jeffland
Champion

Hm, that's interesting. I must admit I've had my share of weird moments with timechart (with bins and span in particular). Is there any other setting you could use, e.g. minspan, that might help splunk identify the right bin size on its own without the need for bins? timechart really has a host of options. Unfortunately, I can't pinpoint the appropriate setting for you right off the bat.

0 Karma

johnraftery
Communicator

Ok, thanks anyway.

0 Karma
Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...