Splunk Search

The automatic timechart range changed after upgrading from Splunk 6.3.1 to 6.3.3. What can we set to revert to the old behavior?

johnraftery
Communicator

We have certain source types where there is only data from months ago. When putting this into a timechart, the chart was smart enough to see that it didn't need to display months of nothing, so the earliest and latest end of the chart were set to the earliest and latest times of the data. That was in 6.3.1. We've just upgraded to 6.3.3, and this is no longer working. Now, the chart shows everything from the start of the data until now, which is not useful at all. Is there a flag or something that we can set to revert to the old behavior?

Many thanks,
John Raftery

0 Karma

jeffland
SplunkTrust
SplunkTrust

Have you had a look at the fixedrange argument for timechart? The description sounds interesting:

Specify whether or not to enforce the earliest and latest times of the search. Setting fixedrange=false allows the timechart command to constrict to just the time range with valid data. 
0 Karma

johnraftery
Communicator

Thanks for pointing me towards fixedrange - this seems related to what I need. In the end though it just puts all of my data into one bin. This is my query:
eventtype=mlc sourcetype=vmstat-linux host=DBS_TEST_engine_profiler4 | timechart fixedrange=false bins=100 avg(cpu_used) by source
Interestingly, if I change bins=100 into span=1m, it produces what I want. However, I can't use span=1m because often there would be too many points to display - when the time range is too long.

0 Karma

jeffland
SplunkTrust
SplunkTrust

Hm, that's interesting. I must admit I've had my share of weird moments with timechart (with bins and span in particular). Is there any other setting you could use, e.g. minspan, that might help splunk identify the right bin size on its own without the need for bins? timechart really has a host of options. Unfortunately, I can't pinpoint the appropriate setting for you right off the bat.

0 Karma

johnraftery
Communicator

Ok, thanks anyway.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...