Hi,
The timechart in advanced XML creates its own bins of milliseconds. See below
Whereas in simple XML, it doesn't. See below
How to get this simple XML behavior in advanced XML?
Thanks,
Strive
The span is specified in the search. It is span=1d
That is the minimum span that we can specify
for the search macro, the span value is passed as an argument. There are two possible values: 1d and 7d.
The problem is when span=1d
If you do not want to mess around with xml, you could enforce span size for timechart.
http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/timechart
For example:
... | timechart span=1h ...
Already span is specified in the search. It is span=1d
That is the minimum span that we can specify