Refine your search:

I am currently running a single hidden search to power all the graphs on my dashboard.

The time range for the base search is 3 hours.

  <module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" autoRun="True">
  <param name="savedSearch">Search Base</param>

The PostProcess then does another search to filter the results, which also works correctly.

However when the time chart is created the MIN & MAX Time Range is changed to first/last seen events, when I need it to stay as 3 Hours.

It works correctly if I run the search manually, is there something I'm missing?

<module name="HiddenPostProcess" layoutPanel="panel_row2_col1_grp1">
 <param name="search"> search page="www.homepage.com" | timechart span="5m" count by Status_Code | fillnull value=0 </param>

<module name="HiddenChartFormatter">
      <param name="chart">bar</param>
      <param name="charting.axisY.minimumNumber"> </param>
      <param name="charting.axisY.maximumNumber"> </param>
      <param name="charting.chart.axisX.includeZero">true</param>
      <param name="charting.chart.nullValueMode">zero</param>
      <param name="charting.legend.labels">[500,404,200]</param>
      <param name="charting.seriesColors">[0xFF0000,0xFFE87C,0x41A317]</param>
      <param name="charting.legend.masterLegend"></param>
     <param name="charting.primaryAxisLabels.majorLabelVisibility">hide</param>
      <param name="charting.chart.stackMode">stacked</param>
      <param name="primaryAxisTitle.text"> </param>
      <param name="secondaryAxisTitle.text"> </param>
      <param name="legend.placement">top</param>
        <module name="FlashChart">
          <param name="width">100%</param>
          <param name="height">435px</param>
        </module>
    </module>

Any thoughts would be helpful!

Thanks.

asked 26 Aug '11, 03:55

Joshua's gravatar image

Joshua
432
accept rate: 0%


One Answer:

I was running through a similar problem, and the solution turned out to be to add "fixedrange=false" to my timechart command. It seems we're running Splunk 4.1, and this makes the chart grow or shrink to fit the data being fed into it, rather than being stuck at the definition of earliest/latest.

link

answered 19 Dec '11, 16:57

batzel's gravatar image

batzel
213
accept rate: 0%

Post your answer
toggle preview

Copyright © 2005-2012 Splunk, Inc. All rights reserved.