Splunk Dev

span not working with db query

Esky73
Builder

i have a search like so :

| dbxquery query="SELECT some select statement
| eval u_total_time=u_total_time/1000
| chart avg(u_total_time) over u_real_hit_time by u_short_description span=1m

However the span=1 seems to be ignored and the results are still presenting in second intervals.

I have moved the span cmd to after the chart cmd and also tried using stats and timechart but the span cmd is ignored in all searches.

Ideas ?

cheers.

Tags (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

The span attribute works on the column preceding it. Does the u_short_description field contains timestamp in epoch format? If the u_real_hit_time field contains timestamp, then you need to move span just after that in chart command.

| dbxquery query="SELECT some select statement
| eval u_total_time=u_total_time/1000 
| chart avg(u_total_time) over u_real_hit_time span=1m by u_short_description 

See this for example
http://docs.splunk.com/Documentation/Splunk/6.5.3/SearchReference/Chart#6:_Chart_the_number_of_event...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...