Hi, I am new to splunk and am trying to build one timechart. we have the following timechart search query which is not giving the correct values in statistics but when we browse the events from the statistics the required data seems to be there. Not able to figure out how timechart exactly works here. Query as below , request help / explanation for the behavior. Filtered for a particular bizname, I select the date range from say 00:45 to 1:30 for a particular day. I get the wrong "Percentage" value [say 60%] for the first block [00:45 to 1:00], but when go to the events and check it comes out to be 93%. What am I doing wrong here. index=index1 sourcetype=*XYZ* | dedup col1, col2,col3 | search bizname="ABC" | where completed in("Y","N") | eval status=if(completed ="Y",100,0) | timechart span=15m mean(status) as Percentage by bizname useother=false limit=100 | fillnull value=100 Thanks.
... View more