Splunk Search

How does 'partial=True' affects 'timechart' results?

abonuccelli_spl
Splunk Employee
Splunk Employee

I am grouping time buckets using 'span' and I'd like to trim partial time buckets at the beginning and end of the search of the time line as they're not representative of a full span period

Tags (2)
1 Solution

abonuccelli_spl
Splunk Employee
Splunk Employee

Below the difference in how results are presented (or omitted)

partial=False

user@workstation-486-DX2-66 /opt/splunk/bin $ ./splunk search "sourcetype=psql-lab-dbx_feeder_tsb_7848 earliest=-20m@m | timechart span=5m count partial=False"
INFO: Your timerange was substituted based on your search string
           _time            count
--------------------------- -----
2014-07-01 09:15:00.000 BST   310
2014-07-01 09:20:00.000 BST   546
2014-07-01 09:25:00.000 BST   577

partial=True

user@workstation-486-DX2-66 /opt/splunk/bin $ ./splunk search "sourcetype=psql-lab-dbx_feeder_tsb_7848 earliest=-20m@m | timechart span=5m count partial=True"
INFO: Your timerange was substituted based on your search string
           _time            count
--------------------------- -----
2014-07-01 09:10:00.000 BST     0
2014-07-01 09:15:00.000 BST   310
2014-07-01 09:20:00.000 BST   546
2014-07-01 09:25:00.000 BST   577
2014-07-01 09:30:00.000 BST   533

View solution in original post

abonuccelli_spl
Splunk Employee
Splunk Employee

Below the difference in how results are presented (or omitted)

partial=False

user@workstation-486-DX2-66 /opt/splunk/bin $ ./splunk search "sourcetype=psql-lab-dbx_feeder_tsb_7848 earliest=-20m@m | timechart span=5m count partial=False"
INFO: Your timerange was substituted based on your search string
           _time            count
--------------------------- -----
2014-07-01 09:15:00.000 BST   310
2014-07-01 09:20:00.000 BST   546
2014-07-01 09:25:00.000 BST   577

partial=True

user@workstation-486-DX2-66 /opt/splunk/bin $ ./splunk search "sourcetype=psql-lab-dbx_feeder_tsb_7848 earliest=-20m@m | timechart span=5m count partial=True"
INFO: Your timerange was substituted based on your search string
           _time            count
--------------------------- -----
2014-07-01 09:10:00.000 BST     0
2014-07-01 09:15:00.000 BST   310
2014-07-01 09:20:00.000 BST   546
2014-07-01 09:25:00.000 BST   577
2014-07-01 09:30:00.000 BST   533

andreyminakov
Explorer

It doesn't work in my case...

0 Karma

andreyminakov
Explorer

I understood the principle of "partial" working exactly as maciep, and I don't see anything opposite in documentation. The only suspicious thing is that it is said in the documentation that «Only the first and last bin can be partial.». As far as I understand, the first and the last bins have always be consider as partial. Otherwise the system has to have some logic to understand where the first or/and last bins are partial or not. And IMHO this is impossible, because the software cannot understand whether e.g. the first period is incomplete, or there just really weren’t any events during the first part of this first bean.

The same issue is here:
https://answers.splunk.com/answers/432520/why-is-timechart-partialfalse-still-returning-part.html
https://answers.splunk.com/answers/418447/how-is-the-partial-flag-supposed-to-work-with-time.html

So it would be great to solve that issue.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...