Splunk Search

Bucket time span causing incorrect date entries

ohlafl
Communicator

I have the following query:

some query... | bucket _time span=1d | eval date=strftime(_time, "%b %d, %Y") | chart avg(value) as Value over date

Which is tethered to the following time span:

 <earliest>-$global_time$d@d</earliest>
 <latest>-1@d</latest>

Where global_time can be any integer representing a number of days.

The data that comes out is correct but the statistics (and therefor visualization) always show the first day of the current month as the first entry, if I search over let's say 40 days I get the following result:

1st July ... 28th July, 24th June, 25th June, 26th June, 29th June... until 40 posts has been filled. What is wrong here???

Weekends are not included as there is no output data for Value during those days.

Tags (4)
0 Karma
1 Solution

woodcock
Esteemed Legend

It is because your date field is being sorted alphabetically and "1" always comes first. Try this:

some query... | bucket _time span=1d | eval date=_time | fieldformat date=strftime(date, "%b %d, %Y") | chart avg(value) as Value over date

View solution in original post

woodcock
Esteemed Legend

It is because your date field is being sorted alphabetically and "1" always comes first. Try this:

some query... | bucket _time span=1d | eval date=_time | fieldformat date=strftime(date, "%b %d, %Y") | chart avg(value) as Value over date

ohlafl
Communicator

Thank you.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...