Splunk Search

Why is my time search not showing expected results with a relative time picker input?

idab
Path Finder

Hello everyone,

Need your help. I have this dashboard to display some counter information for each host over a certain period of time - using the search tab called "select time", but when I start a search to show the information over the past 24hours or 7days - (Relative), the output on the graph is not well defined as shown on the snapshot below:alt text

This is my search criteria :

index=perfmon counter="Avg. Disk sec/Transfer"  Host="*" collection=LogicalDisk earliest=-1m [search index=perfmon counter="Avg. Disk sec/Transfer"  host=$host$ collection=LogicalDisk earliest=-1m | stats max(Value) as latency by host | sort 10 -Value | fields host ]  | eval dataValue= "avg disk sec/transfer:" + tostring(round(Value,3)*1000)  | makemv delim="," allowempty=true dataValue  | mvexpand dataValue  | eval part=split(dataValue,":")  | eval category = Host + ":" + mvindex(part,0)  | eval dataPoint = tonumber(mvindex(part,1))  | timechart span=1s latest(dataPoint) by category

Is there a way to resolve this?

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Remove earliest=-1m from your search. This is forcing the time over what you choose in the drop down list.

------------
Hope I was able to help you. If so, some karma would be appreciated.
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...