Splunk Search

Using span option with timechart causes incorrect column names.

yutaka1005
Builder

Splunk Ver : I tested in 7.3.0 and 6.6.12.
Timezone : I don't know if it’s relevant to this problem, but it is JST

If I run following search, column name will be "99".

| makeresults count=10 
| eval field=99
| timechart count by field

But If I using span option like below, column name changes.

Pattern 1)
    | makeresults count=10 
    | eval field=99
    | timechart count by field span=1h
Result 1)
    column name changes to "0".

Pattern 2)
    | makeresults count=10 
    | eval field=99
    | timechart count by field span=1m
Result 2)
    column name changes to "60".

Pattern 3)
    | makeresults count=10 
    | eval field=99
    | timechart count by field span=1d
Result 3)
    column name changes to "-32400"!

This time, I used makeresults as a sample.
But, if I want to use timechart by some number field like destination port or ID_number in actual operation, it would be a problem if the displayed column names are different.

Is this issue?
Or specification? If so, is there a way to avoid?

alt text

0 Karma
1 Solution

yutaka1005
Builder

Sorry... moving span option to after timechart command like below, it worked correctly...

Before)
timechart count by field span=1h

After)
timechart span=1h count by field

I was thinking that I can put span option anywhere.

View solution in original post

0 Karma

yutaka1005
Builder

Sorry... moving span option to after timechart command like below, it worked correctly...

Before)
timechart count by field span=1h

After)
timechart span=1h count by field

I was thinking that I can put span option anywhere.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi yutaka1005,
span hasn't any impact on column names, can you share your search, probably the cause of this behaviour is in the search.

Bye.
Giuseppe

yutaka1005
Builder

Sorry, it was solved by myself.

Thank you for comment!

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...