Splunk Search

Why is my time search not showing expected results with a relative time picker input?

idab
Path Finder

Hello everyone,

Need your help. I have this dashboard to display some counter information for each host over a certain period of time - using the search tab called "select time", but when I start a search to show the information over the past 24hours or 7days - (Relative), the output on the graph is not well defined as shown on the snapshot below:alt text

This is my search criteria :

index=perfmon counter="Avg. Disk sec/Transfer"  Host="*" collection=LogicalDisk earliest=-1m [search index=perfmon counter="Avg. Disk sec/Transfer"  host=$host$ collection=LogicalDisk earliest=-1m | stats max(Value) as latency by host | sort 10 -Value | fields host ]  | eval dataValue= "avg disk sec/transfer:" + tostring(round(Value,3)*1000)  | makemv delim="," allowempty=true dataValue  | mvexpand dataValue  | eval part=split(dataValue,":")  | eval category = Host + ":" + mvindex(part,0)  | eval dataPoint = tonumber(mvindex(part,1))  | timechart span=1s latest(dataPoint) by category

Is there a way to resolve this?

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Remove earliest=-1m from your search. This is forcing the time over what you choose in the drop down list.

------------
Hope I was able to help you. If so, some karma would be appreciated.
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...