Splunk Search

Timechart - Same time range and span but different timeline

n0cturne
Loves-to-Learn

Hello,

i've put two timecharts on top of each other to compare their events by time. Both timecharts are using the same time range and span.

The top timechart has many data points  whereas the bottom has just a few.

How can I show the same time range on the x-axis in both timecharts?

 

timecharts.png

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

That is interesting because I recreated your inputs and charts (of course with different searches, but also timechart ones) and they seem to be working fine. I noticed however that you posted this on 30.09.2021 but have data from 1.10.2021 already. If you have data from the future, you might hit similar issue as https://community.splunk.com/t5/Splunk-Enterprise/help-on-basic-question-about-span-in-timechart/m-p...

0 Karma

n0cturne
Loves-to-Learn

Both timecharts are using a global time token (7d in this case) and span=1d.
I've expected, that both x-axis were matching.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Maybe it's what you tried to do, but they're definitely not sharing either the range nor the span.

1 day span produces a single value per day and your upper linechart has resolution of - i don't know - 1 hour?

So no, there's something wrong.  We don't know what because we don't see the definitions.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

What do you mean by "Both timecharts are using the same time range and span"?

The upper chart is definitely over a longer range (whole week, I think) than the lower one (this one covers less than a day).

0 Karma

n0cturne
Loves-to-Learn

Here are my panels and settings.



inputs:

 

    <input type="time" token="time_infra">
      <label>Time Range</label>
      <default>
        <earliest>-48h</earliest>
        <latest></latest>
      </default>
    </input>
    <input type="dropdown" token="span" searchWhenChanged="false">
      <label>Span</label>
      <choice value="1m">1 min</choice>
      <choice value="5m">5 min</choice>
      <choice value="15m">15 min</choice>
      <choice value="30m">30 min</choice>
      <choice value="1h">1 hour</choice>
      <choice value="2h">2 hours</choice>
      <choice value="4h">4 hours</choice>
      <choice value="8h">8 hours</choice>
      <choice value="12h">12 hours</choice>
      <choice value="1d">1 day</choice>
      <choice value="1w">1 week</choice>
      <default>5m</default>
      <initialValue>5m</initialValue>
    </input>
    <input type="dropdown" token="refresh_rate">
      <label>Refresh rate</label>
      <choice value="1m">1 min</choice>
      <choice value="3m">3 min</choice>
      <choice value="5m">5 min</choice>
      <choice value="10m">10 min</choice>
      <choice value="15m">15 min</choice>
      <choice value="30m">30 min</choice>
      <choice value="1h">1 h</choice>
      <default>10m</default>
      <initialValue>10m</initialValue>
    </input>

 


top chart:

 

    <panel id="heap_back">
      <html>
         <style>
           #heap_back{
             width:30% !important;
           }
         </style>
       </html>
      <chart>
        <title>....Backend</title>
        <search>
          <query>index=ascrm sourcetype=jmx heap_used=* heap_max=* crm_tier=backend
| fields host,heap_used,heap_max
| eval hu=100/heap_max*heap_used
| rex field=host "(?&lt;hostname&gt;[^.]+)\."
| timechart span=$span$ eval(round(p99(hu),0)) by hostname</query>
          <earliest>$time_infra.earliest$</earliest>
          <latest>$time_infra.latest$</latest>
          <sampleRatio>1</sampleRatio>
          <refresh>$refresh_rate$</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisLabelsY.majorUnit">10</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.maximumNumber">100</option>
        <option name="charting.axisY.minimumNumber">0</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">connect</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">seriesCompare</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="height">300</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>

 



bottonm chart:

 

    <panel id="gc_back">
      <html>
         <style>
           #gc_back{
             width:30% !important;
           }
         </style>
       </html>
      <chart>
        <title>....Backend</title>
        <search>
          <query>index=ascrm sourcetype=crm_log_gc crm_tier=backend "Pause Full (Diagnostic Command)"
| timechart span=$span$ count by host</query>
          <earliest>$time_infra.earliest$</earliest>
          <latest>$time_infra.latest$</latest>
          <sampleRatio>1</sampleRatio>
          <refresh>$refresh_rate$</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">connect</option>
        <option name="charting.chart.showDataLabels">minmax</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">seriesCompare</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="height">300</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>

 


It seem all to be correct.


But the charts haven't synchonous timelines.
timecharts_2.png

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...