Splunk Search

Timechart not working for 30days and more

nivethainspire_
Explorer

My timechart is working perfectly for last 10 days but it is not working for time range above 15 days.Any idea to resolve this?
please find the screenshot of the query.

alt text

0 Karma

niketn
Legend

@nivethainspire_07, do you really need join? I dont see the need for creating src field (you have not used it afterward). replace and fillnull can be placed after the transforming command so that they operate on aggregated field/s. Please try out the following instead:

 index="sae2" OR index="sae"
| timechart count by xyx
| replace "True" with "x" "False" with "y"
| fillnull value="Missing" xyz
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

cmerriman
Super Champion

do you get an error in the Job dropdown? Anything about subsearch timeout or truncating because of too many events? could you try rewriting the query to see if that helps?

index=sae2 OR index=sae 
|rename Name as clienthost
|eval src=if(index="sae2","aaa","tw")
|replace True with x False with y in xyz
|fillnull value="Missing" xyz
|timechart span=1d count by xyz
0 Karma

HiroshiSatoh
Champion

Please tell me how it will not move.

For example, is the limit of maxout of sub search OK?
http://docs.splunk.com/Documentation/Splunk/6.6.3/Admin/Limitsconf

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...