Re: Timechart - Same time range and span but diffe...

n0cturne · ‎09-30-2021

Hello,

i've put two timecharts on top of each other to compare their events by time. Both timecharts are using the same time range and span.

The top timechart has many data points whereas the bottom has just a few.

How can I show the same time range on the x-axis in both timecharts?

PickleRick · ‎10-01-2021

That is interesting because I recreated your inputs and charts (of course with different searches, but also timechart ones) and they seem to be working fine. I noticed however that you posted this on 30.09.2021 but have data from 1.10.2021 already. If you have data from the future, you might hit similar issue as https://community.splunk.com/t5/Splunk-Enterprise/help-on-basic-question-about-span-in-timechart/m-p...

n0cturne · ‎09-30-2021

Both timecharts are using a global time token (7d in this case) and span=1d.
I've expected, that both x-axis were matching.

PickleRick · ‎09-30-2021

Maybe it's what you tried to do, but they're definitely not sharing either the range nor the span.

1 day span produces a single value per day and your upper linechart has resolution of - i don't know - 1 hour?

So no, there's something wrong. We don't know what because we don't see the definitions.

PickleRick · ‎09-30-2021

What do you mean by "Both timecharts are using the same time range and span"?

The upper chart is definitely over a longer range (whole week, I think) than the lower one (this one covers less than a day).

n0cturne · ‎09-30-2021

Here are my panels and settings.

inputs:

    <input type="time" token="time_infra">
      <label>Time Range</label>
      <default>
        <earliest>-48h</earliest>
        <latest></latest>
      </default>
    </input>
    <input type="dropdown" token="span" searchWhenChanged="false">
      <label>Span</label>
      <choice value="1m">1 min</choice>
      <choice value="5m">5 min</choice>
      <choice value="15m">15 min</choice>
      <choice value="30m">30 min</choice>
      <choice value="1h">1 hour</choice>
      <choice value="2h">2 hours</choice>
      <choice value="4h">4 hours</choice>
      <choice value="8h">8 hours</choice>
      <choice value="12h">12 hours</choice>
      <choice value="1d">1 day</choice>
      <choice value="1w">1 week</choice>
      <default>5m</default>
      <initialValue>5m</initialValue>
    </input>
    <input type="dropdown" token="refresh_rate">
      <label>Refresh rate</label>
      <choice value="1m">1 min</choice>
      <choice value="3m">3 min</choice>
      <choice value="5m">5 min</choice>
      <choice value="10m">10 min</choice>
      <choice value="15m">15 min</choice>
      <choice value="30m">30 min</choice>
      <choice value="1h">1 h</choice>
      <default>10m</default>
      <initialValue>10m</initialValue>
    </input>

top chart:

    <panel id="heap_back">
      <html>
         <style>
           #heap_back{
             width:30% !important;
           }
         </style>
       </html>
      <chart>
        <title>....Backend</title>
        <search>
          <query>index=ascrm sourcetype=jmx heap_used=* heap_max=* crm_tier=backend
| fields host,heap_used,heap_max
| eval hu=100/heap_max*heap_used
| rex field=host "(?&lt;hostname&gt;[^.]+)\."
| timechart span=$span$ eval(round(p99(hu),0)) by hostname</query>
          <earliest>$time_infra.earliest$</earliest>
          <latest>$time_infra.latest$</latest>
          <sampleRatio>1</sampleRatio>
          <refresh>$refresh_rate$</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisLabelsY.majorUnit">10</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.maximumNumber">100</option>
        <option name="charting.axisY.minimumNumber">0</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">connect</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">seriesCompare</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="height">300</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>

bottonm chart:

    <panel id="gc_back">
      <html>
         <style>
           #gc_back{
             width:30% !important;
           }
         </style>
       </html>
      <chart>
        <title>....Backend</title>
        <search>
          <query>index=ascrm sourcetype=crm_log_gc crm_tier=backend "Pause Full (Diagnostic Command)"
| timechart span=$span$ count by host</query>
          <earliest>$time_infra.earliest$</earliest>
          <latest>$time_infra.latest$</latest>
          <sampleRatio>1</sampleRatio>
          <refresh>$refresh_rate$</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">connect</option>
        <option name="charting.chart.showDataLabels">minmax</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">seriesCompare</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="height">300</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>

It seem all to be correct.

But the charts haven't synchonous timelines.

Timechart - Same time range and span but different timeline

timechart

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Join the Conversation