Splunk Search

Why are there missing days in the results of my "Month to date" chart search?

_gkollias
Builder

I have a search where I want to calculate total transaction volumes over time by transaction type. I'm populating results, but I notice there are some days missing. Here is a screen shot:

 http://screencast.com/t/zNVURLk8Je 

Here is the search I am using:

index=foo sourcetype=bar
| bucket span=1d _time
| dedup id
| stats count as volume, latest(transaction_type ) as transaction_type by djarfrrw, _time
| eval _time=strftime(_time, "%m/%d/%Y")
| chart max(volume) over transaction_type by _time usenull=f useother=f

Is there anything in the search that might be causing the missing days?

Thanks in Advance!

0 Karma
1 Solution

sloshburch
Splunk Employee
Splunk Employee

If the issue is persisting, I would try writing the search another way to leverage the timechart command. If this works out for you, its more of a native approach and less error-prone than extract the date from the time field. Plus it probably performs faster since its less commands:

index=foo sourcetype=bar id=*
 | dedup id
 | timechart span=1d count as volume, latest(transaction_type ) as transaction_type by djarfrrw

View solution in original post

sloshburch
Splunk Employee
Splunk Employee

If the issue is persisting, I would try writing the search another way to leverage the timechart command. If this works out for you, its more of a native approach and less error-prone than extract the date from the time field. Plus it probably performs faster since its less commands:

index=foo sourcetype=bar id=*
 | dedup id
 | timechart span=1d count as volume, latest(transaction_type ) as transaction_type by djarfrrw

richgalloway
SplunkTrust
SplunkTrust

Have you verified there are events on those days?

---
If this reply helps you, Karma would be appreciated.
0 Karma

_gkollias
Builder

yeah...so I removed usenull/other=f and got the daily counts....I guess chart isn't as "smart" as timechart?

0 Karma

somesoni2
Revered Legend

So do you still have missing dates OR it's resolved?

0 Karma

_gkollias
Builder

I still see the issue...If i run the search in 7 day increments things look ok...when I use Month to Date things are not populating correctly...not quite sure why.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...