Splunk Search

The automatic timechart range changed after upgrading from Splunk 6.3.1 to 6.3.3. What can we set to revert to the old behavior?

johnraftery
Communicator

We have certain source types where there is only data from months ago. When putting this into a timechart, the chart was smart enough to see that it didn't need to display months of nothing, so the earliest and latest end of the chart were set to the earliest and latest times of the data. That was in 6.3.1. We've just upgraded to 6.3.3, and this is no longer working. Now, the chart shows everything from the start of the data until now, which is not useful at all. Is there a flag or something that we can set to revert to the old behavior?

Many thanks,
John Raftery

0 Karma

jeffland
Champion

Have you had a look at the fixedrange argument for timechart? The description sounds interesting:

Specify whether or not to enforce the earliest and latest times of the search. Setting fixedrange=false allows the timechart command to constrict to just the time range with valid data. 
0 Karma

johnraftery
Communicator

Thanks for pointing me towards fixedrange - this seems related to what I need. In the end though it just puts all of my data into one bin. This is my query:
eventtype=mlc sourcetype=vmstat-linux host=DBS_TEST_engine_profiler4 | timechart fixedrange=false bins=100 avg(cpu_used) by source
Interestingly, if I change bins=100 into span=1m, it produces what I want. However, I can't use span=1m because often there would be too many points to display - when the time range is too long.

0 Karma

jeffland
Champion

Hm, that's interesting. I must admit I've had my share of weird moments with timechart (with bins and span in particular). Is there any other setting you could use, e.g. minspan, that might help splunk identify the right bin size on its own without the need for bins? timechart really has a host of options. Unfortunately, I can't pinpoint the appropriate setting for you right off the bat.

0 Karma

johnraftery
Communicator

Ok, thanks anyway.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...