I have the following saved query display as a graph in a view
index="generator" CustomGenerator earliest=-12h latest=-1m | rex field=_raw "sessionid : (?
This gives me a graph of unique sessions per minute over the last 12 hours and seems to work fine.
However, what I really want is this graph over the last 24 hours. When I change earliest=-12h to earliest=-24h, the graph only displays the last 15 hours or so.
How can I best get around this?
I'd assume it's probably because you have span=1m, which would result in 1440 different buckets, which is probably more than the timechart can handle. What happens if you change it to span=2m?
If that doesn't solve it, what happens when you run the query from the normal search window (and look at it in tabular format). Do you still see only 15 hours of data?
Someone might jump in and tell me otherwise, but I'm not sure you'll get around the limit. Would you get what you need by using span=1m and adding a
| timechart span=2m avg(Sessions) as Sessions at the end?