Hello everyone,
Need your help. I have this dashboard to display some counter information for each host over a certain period of time - using the search tab called "select time", but when I start a search to show the information over the past 24hours or 7days - (Relative), the output on the graph is not well defined as shown on the snapshot below:
This is my search criteria :
index=perfmon counter="Avg. Disk sec/Transfer" Host="*" collection=LogicalDisk earliest=-1m [search index=perfmon counter="Avg. Disk sec/Transfer" host=$host$ collection=LogicalDisk earliest=-1m | stats max(Value) as latency by host | sort 10 -Value | fields host ] | eval dataValue= "avg disk sec/transfer:" + tostring(round(Value,3)*1000) | makemv delim="," allowempty=true dataValue | mvexpand dataValue | eval part=split(dataValue,":") | eval category = Host + ":" + mvindex(part,0) | eval dataPoint = tonumber(mvindex(part,1)) | timechart span=1s latest(dataPoint) by category
Is there a way to resolve this?
Remove earliest=-1m from your search. This is forcing the time over what you choose in the drop down list.