Splunk Search

A great Charting Problem!

Dark_Ichigo
Builder

I do not understand why Im currently having this problem, I have never had this problem before when creating charts with splunk!

The problem is when using the follwing search to create a chart with span=5m within a Timestamp of a whole Month:

index="INDEX" GET* | timechart bins=50000 span=5m count

I only get three days, and the rest of the days seem to shift to the right of the chart and disappear as it loads!

This is a very weird behaviour, I dont understand why its behaving like this, the flashtime search works fine with all the results for that month, but when creating the chart it doesn't seem to work normally

1 Solution

Takajian
Builder

The maximum points of x-axis is 1000 points in splunk chart. Therefore you will not be able to create monthly report with such a small time span like 5m. Can you change time span to span=1d ? Then you will see whole chart in the month. You will need to adjust them to what you want to see.

View solution in original post

arthurjspencer
Engager

In simple XML you can increase the number of points in a chart by including.

5000

0 Karma

Takajian
Builder

The maximum points of x-axis is 1000 points in splunk chart. Therefore you will not be able to create monthly report with such a small time span like 5m. Can you change time span to span=1d ? Then you will see whole chart in the month. You will need to adjust them to what you want to see.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...