Dashboards & Visualizations

Seach query for timeseries does not work for all timeranges

rantravee
Path Finder

Hi,

I'm using a script to poll at each minute a WebApi for statistics. The result is a json object that is then indexed into Splunk. Next I want to visualize some of the statistics, therefore I employ a couple of dashboards/forms , each coupled with a search to render timeseries about that statistic.

The search query is like "source="mysource" | timechart span=1m avg(json_response.statistic_x)"

This works OK for some time ranges (15min, 60min, 4h) but for 24h interval or greater nothing is plotted. It is like in this case no event matches the query which is very strange,since there is data.

If I remove the span then for the 15 min interval I get around 15 unconnected points in the graph representing each indexed event. Additionally in this case I see there are much more results than matching events.

Could someone throw some light on what is happening and how could a consistent behavior for all time samples be obtained ?

0 Karma

lguinn2
Legend

I think that you can't get a consistent behavior for all time samples, because you just have too many data points in the longer intervals. Splunk may be able to compute the data using stats, but it can't display that data in a timechart unless you change the span.

Here is an old quote, but I think it is still true:

"Splunk's chart rendering subsystem is configured to only show 500 data rows by default, as each point takes a couple of pixels and it's unlikely that your display device has more than a few thousand pixels. I'm assuming that your table below the chart shows all 2160 rows of data."

from http://answers.splunk.com/answers/5109/forcing-report-to-chart-last-month-of-data

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...