Splunk Search

In Splunk versions after 6.4.3, chart using span=log no longer works. Is there a workaround?

rdominy
Engager

I was successfully using the following query with Splunk 6.4.3:

index="pixelscoredata"| chart count by imps_budget bins=10 span=log

But as of 6.4.4 and 6.5.0 it now throws the following error:

"Error in 'chart' command: The value for option span is invalid: 'log'. "

This still works fine if using timechart instead of chart. I've tried a number of variations such as specifying the coefficient and base without success. The documentation shows it still being supported.

Is this a known bug? Any workarounds?

0 Karma
1 Solution

rdominy
Engager

We found the problem. We had a file import with source type set to automatic and it ended up creating over 80K rows of new types and was severely slowing down the system. That appears to have been causing some under-the-covers timeout in searches on other indexes because as soon as we cleaned that up, span=log began working.

TL;DR If features stop working (even coincidently after a software upgrade), check your imports and source types and avoid "automatic" source types.

View solution in original post

0 Karma

rdominy
Engager

We found the problem. We had a file import with source type set to automatic and it ended up creating over 80K rows of new types and was severely slowing down the system. That appears to have been causing some under-the-covers timeout in searches on other indexes because as soon as we cleaned that up, span=log began working.

TL;DR If features stop working (even coincidently after a software upgrade), check your imports and source types and avoid "automatic" source types.

0 Karma

cmerriman
Super Champion

I shortened the timeframe and got it to work, but when I'm looking for a longer period of time, it works for a few seconds and errors out.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...