Splunk Search
Highlighted

using span and bin in timechart

Splunk Employee
Splunk Employee

Can you have both span=x and bins=y in timechart? If both are specified, which one wins?

0 Karma
Highlighted

Re: using span and bin in timechart

Splunk Employee
Splunk Employee

It should flag it as an error/warning, but currently it is not. span will win.

View solution in original post

Highlighted

Re: using span and bin in timechart

SplunkTrust
SplunkTrust

Short answer - no you cannot have both, and if you do, the 'span' will win.

The longer answer is that technically you can 'bin' other fields besides time. In the timechart below, im setting a span for the _time, but note the bins=3. That is actually telling timechart to bin the date_hour values into numeric ranges.

index=_internal source=*metrics.log group=per_index_thruput series!=_internal | timechart span=1h sum(kb) by date_hour bins=3

View solution in original post

Highlighted

Re: using span and bin in timechart

Splunk Employee
Splunk Employee

You know what's awesome when you bin fields other than time? logarithmic spans: `index=weblogs | bin responseTime span=1.2log1.6 | stats count by responseTime

Highlighted

Re: using span and bin in timechart

SplunkTrust
SplunkTrust

fine. outdo me and get the last word. my mom still thinks im cool.