Splunk Search

Timechart vs chart behaviour

ghildiya
Explorer

When I run following query:

 

.... | bin _time span=5m | timechart  avg(responseTime)

 

 

(responseTime is an extracted field)

What I understand of this query is this:

Divide timeline in a series of buckets of 5 minutes duration each, find average of responseTime  for each such bucket and plot the graph(average of responsetime as Y axis, for timechart X axis is always time).

I see graph as:

timechart.PNGSo I see graph is not continuous, as there may be time slots when there is no record and hence no data point.

Now, if I change my query to:

 

.... | bin _time span=5m | chart  avg(responseTime) by _time

 

 

My understanding is that this query should behave same as first one.

But graph I see is as:

chart.PNG In contrast to first graph, this one is continuous without any break.

I am not able to understand why the two queries behave differently.

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Both commands are supposed to fill in missing values by default.  Try this to see if the output is any different.

.... | timechart span=5m avg(responseTime) ``` No bin command```

You can try this to see if you get results similar to what you got from timechart.

.... | bin _time span=5m | chart cont=false avg(responseTime) by _time

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

L0gik2
New Member

How can you break this out into multiple lines from here?  For example I am working on a line chart of speed by vehicle across mileposts.  I can do speed by vehicle or speed by milepost.  

To get speed at mileposts I have used:

|  chart values(speed) BY Milepost

 

X axis would be mileposts, Y axis is speed and then line by Vehicle_ID

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Both commands are supposed to fill in missing values by default.  Try this to see if the output is any different.

.... | timechart span=5m avg(responseTime) ``` No bin command```

You can try this to see if you get results similar to what you got from timechart.

.... | bin _time span=5m | chart cont=false avg(responseTime) by _time

 

---
If this reply helps you, Karma would be appreciated.

ghildiya
Explorer

Yes, the first query results in a continuous curve. 

 

So , the difference between mine and yous query is that I have explicitly used 

| bin _time span=5m |

 

..while you have used span with timchart.

Can you explain how does it make difference conceptually?

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
I wish I knew. 😉
---
If this reply helps you, Karma would be appreciated.
0 Karma

ghildiya
Explorer

Upvoted already.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...