Splunk Search

how come some fields disappear when they go into timechart/chart?

sideview
SplunkTrust
SplunkTrust

Im trying to use timechart to pass along the values of a particular field for each time bucket.

I know that the fields are there, and that the fields exist in 100% of the events. However values() and first() are not finding them:

eg:

index="_internal" source="*metrics.log" group=tcpin_connections sourceHost=* | timechart values(sourceHost) dc(sourceHost)

happily tells me that there are 8 distinct sourceHost values per time bucket, but the values(sourceHost) column says there are no values, and the UI gives me the error:

Specified field(s) missing from results: 'sourceHost'

I've also noticed that some fields like 'destPort' however, are passed along by values() and first() just fine.

Tags (1)
1 Solution

sideview
SplunkTrust
SplunkTrust

What's happening is that timechart and chart try to convert the fields to numeric fields. If that conversion fails for a particular row, they actually throw the field values away.

This is why your values(destPort) works fine, but values(sourceHost) does not. The former survives the conversion.

Although this really seems like a bug, to play devil's advocate, chart and timechart are trying their best to return chartable results. And while categorical values in x-axis and the columns are just fine, in the middle of the table it is just forcing everything to become a number or perish.

The same thing is at work when you have one or two values that pollute your otherwise numeric data -- timechart and chart will have the nice behaviour of ignoring those values for you, and calculate avg() and max() from the remaining values.

Solution: use bin and stats instead of timechart. (or if you're using chart, use stats instead of chart)

Most of the time you'll be able to do whatever it is with stats and other commands. In this particular example it would look like:

bin _time span=5m | stats values(sourceHost) by _time

View solution in original post

sideview
SplunkTrust
SplunkTrust

What's happening is that timechart and chart try to convert the fields to numeric fields. If that conversion fails for a particular row, they actually throw the field values away.

This is why your values(destPort) works fine, but values(sourceHost) does not. The former survives the conversion.

Although this really seems like a bug, to play devil's advocate, chart and timechart are trying their best to return chartable results. And while categorical values in x-axis and the columns are just fine, in the middle of the table it is just forcing everything to become a number or perish.

The same thing is at work when you have one or two values that pollute your otherwise numeric data -- timechart and chart will have the nice behaviour of ignoring those values for you, and calculate avg() and max() from the remaining values.

Solution: use bin and stats instead of timechart. (or if you're using chart, use stats instead of chart)

Most of the time you'll be able to do whatever it is with stats and other commands. In this particular example it would look like:

bin _time span=5m | stats values(sourceHost) by _time
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...