Splunk Search

Why is my time search not showing expected results with a relative time picker input?

idab
Path Finder

Hello everyone,

Need your help. I have this dashboard to display some counter information for each host over a certain period of time - using the search tab called "select time", but when I start a search to show the information over the past 24hours or 7days - (Relative), the output on the graph is not well defined as shown on the snapshot below:alt text

This is my search criteria :

index=perfmon counter="Avg. Disk sec/Transfer"  Host="*" collection=LogicalDisk earliest=-1m [search index=perfmon counter="Avg. Disk sec/Transfer"  host=$host$ collection=LogicalDisk earliest=-1m | stats max(Value) as latency by host | sort 10 -Value | fields host ]  | eval dataValue= "avg disk sec/transfer:" + tostring(round(Value,3)*1000)  | makemv delim="," allowempty=true dataValue  | mvexpand dataValue  | eval part=split(dataValue,":")  | eval category = Host + ":" + mvindex(part,0)  | eval dataPoint = tonumber(mvindex(part,1))  | timechart span=1s latest(dataPoint) by category

Is there a way to resolve this?

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Remove earliest=-1m from your search. This is forcing the time over what you choose in the drop down list.

------------
Hope I was able to help you. If so, some karma would be appreciated.
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...