Timechart graph disappears after loading is complete

[sangs8788]

Hi,

Below is my query which shows be the growth of the database in a year

index=db_connect source = "db2*.log" |dedup _time, TBSP_NAME,DB_NAME | stats sum(TBSP_SIZE_BYTES) as "TBSP_SIZE_BYTES" by _time, DB_NAME |eval TBSP_SIZE_BYTES=round(TBSP_SIZE_BYTES/(1024*1024*1024)) | sort DB_NAME | timechart span=1d last(TBSP_SIZE_BYTES) by DB_NAME

What happens here is, there are distinct 3 databases which the growth has to be shown. And the data is available only from Jun 2017. While running the query the data loads for all 3 databases and later on when loading reaches the finish line, the graph of one db just gradually decrease and disappears.

Could you please let me know what could be the reason behind.

The graph is showing if we specify the DB Name directly (only one single db)
Attached is the screenshot of the same.

Thanks

[cmerriman]

i'm going to just guess it MIGHT have to do with your sort. quick suggestion, try to remove it or try this: | sort 0 DB_NAME i don't think you really need it, since the timechart will put the DB_NAME into columns and you can order them how you want using fields after the timechart command, and since you're doing a stats by _time and DB_NAME earlier, the results would be sorted ascending and then by DB_NAME
sort has a limit to how many events it can sort, and it might be hitting that limit and truncating the results which might be messing with the timechart when it finalizes.

[sangs8788]

@cmerriman It worked. I removed the sort query. Thanks. Please post it as Answer so that I can accept the same