Splunk Search

Timechart not showing all events with small spans


I've got a timechart hooked up to a particular source in my indexes, generated by a script which logs events looking like this every five minutes:

Not Ready,108

A field extraction has been set up on those numbers as ReadyCount and NotReadyCount respectively.

I can timechart these successfully with a string like:

host="my.internal.host" ready latest=now latest=-2d@d | timechart span=5m first(NotReadyCount) as "Not Ready", first(ReadyCount) as "Ready"

This search is connected to a dashboard graph.

My problem is, if I keep that same span and increase the time box to -7d@d, I only get a couple days worth of graph, even though the raw results show me getting all the results I'd hoped for. If I've got, say, two weeks worth of results, the larger time box will result in me getting a graph containing the first 4 days or so.

If I increase the span to 20m, I get a graph containing the last week worth of results like you'd normally expect. Unfortunately, for our purposes, we need the 5 minute resolution on the graph, so reducing the span is not a usable solution, nor is any averaging on the graph results.

How can I get all of my results to show up in the graph correctly?

0 Karma

Re: Timechart not showing all events with small spans

Splunk Employee
Splunk Employee

already answered in other question jschart-truncation

View solution in original post

0 Karma