Timechart question

[estrand]

Hi,
I have the following saved query display as a graph in a view

index="generator" CustomGenerator earliest=-12h latest=-1m | rex field=_raw "sessionid : (?.*)|timechart span=1m dc(sessionid) as Sessions

This gives me a graph of unique sessions per minute over the last 12 hours and seems to work fine.
However, what I really want is this graph over the last 24 hours. When I change earliest=-12h to earliest=-24h, the graph only displays the last 15 hours or so.

How can I best get around this?

Thanks,

-Erik

[David]

I'd assume it's probably because you have span=1m, which would result in 1440 different buckets, which is probably more than the timechart can handle. What happens if you change it to span=2m?

If that doesn't solve it, what happens when you run the query from the normal search window (and look at it in tabular format). Do you still see only 15 hours of data?

[David]

Sure. You might also opt to go for max(Sessions) instead of avg, if you want to insure you have the spikes.

[estrand]

Thanks. That's the closest so far. The avg gives me slightly lower values on the spikes, but not by a lot. I'll leave it like this a few days and see if I can live with it 🙂

[David]

Someone might jump in and tell me otherwise, but I'm not sure you'll get around the limit. Would you get what you need by using span=1m and adding a | timechart span=2m avg(Sessions) as Sessions at the end?

[estrand]

Yes, I forgot to mention that, span=2m gives me 24 hour graph, but the values are different over a 2 minute span than a 1 minute span