Version 6.2.3. I have a dashboard that allows the time range and span to be set at the top for all panels. Most panels' data is gathered every minute. One is gathered every 5 minutes. I would like to specify a dashboard span of 2m, but this produces a spiky visualization for the 5 minute panel (every other plot point is zero). I thought minspan would fix this, but it doesn't. I tried overriding it by setting a variable called this_span to 10m, but I get an error that I can't say "span=this_span". Here's the search: index=os sourcetype=interfaces | multikv fields Name MAC inetAddr inet6Addr Collisions RXbytes RXerrors TXbytes TXerrors Speed Duplex | sort 0 _time | streamstats current=f last(RXbytes) as last_RXbytes last(TXbytes) as last_TXbytes by host | eval delta_rxbytes=RXbytes-last_RXbytes | eval delta_txbytes=TXbytes-last_TXbytes | eval delta_rxbytes=if(delta_rxbytes<0, 0, delta_rxbytes) | eval delta_txbytes=if(delta_txbytes<0, 0, delta_txbytes) | timechart useother=f minspan=10m avg(delta_rxbytes) AS bytes_rx, avg(delta_txbytes) AS bytes_tx by host_short Now using the magnifying glass to get the search shows it put 'span=2m' after the minspan setting. And if I run that search, it plots it spiky; if I take the span=2m out, it plots correctly, but I have no way of doing that when it's in the dashboard. This looks like another form of SPL-59079, only that was fixed some time ago. ... View more