Splunk Search

using span and bin in timechart

kbains
Splunk Employee
Splunk Employee

Can you have both span=x and bins=y in timechart? If both are specified, which one wins?

0 Karma
2 Solutions

steveyz
Splunk Employee
Splunk Employee

It should flag it as an error/warning, but currently it is not. span will win.

View solution in original post

sideview
SplunkTrust
SplunkTrust

Short answer - no you cannot have both, and if you do, the 'span' will win.

The longer answer is that technically you can 'bin' other fields besides time. In the timechart below, im setting a span for the _time, but note the bins=3. That is actually telling timechart to bin the date_hour values into numeric ranges.

index=_internal source=*metrics.log group=per_index_thruput series!=_internal | timechart span=1h sum(kb) by date_hour bins=3

View solution in original post

sideview
SplunkTrust
SplunkTrust

Short answer - no you cannot have both, and if you do, the 'span' will win.

The longer answer is that technically you can 'bin' other fields besides time. In the timechart below, im setting a span for the _time, but note the bins=3. That is actually telling timechart to bin the date_hour values into numeric ranges.

index=_internal source=*metrics.log group=per_index_thruput series!=_internal | timechart span=1h sum(kb) by date_hour bins=3

sideview
SplunkTrust
SplunkTrust

fine. outdo me and get the last word. my mom still thinks im cool.

gkanapathy
Splunk Employee
Splunk Employee

You know what's awesome when you bin fields other than time? logarithmic spans: `index=weblogs | bin responseTime span=1.2log1.6 | stats count by responseTime

steveyz
Splunk Employee
Splunk Employee

It should flag it as an error/warning, but currently it is not. span will win.

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...