Splunk Search

timechart is continous - cannot ignore the timeframe of missing events.

praphulla1
Path Finder

one of our dashboards were using below query
| timechart count span=1d cont=false

in 6.6.4 Splunk enterprise, we could see that it can ignore time-frame for missing data when we use cont=false. In 7.2.6
splunk, the results are different, chart shows the timeframe for missing data.

Attached are screenshots for both splunk versions. I can achieve the expected behavior using stats over one of the field, but i will not be able to use the annotations feature of 7.x. Can you help with this issue to show graph non-continuously and ignore the data for missing timeframe.

If you would like to replicate. use below query along with attached lookup file.

 | inputlookup FDE_incidents_mec.csv 
 | sort 0 by time_epoch desc 
 | addinfo 
 | where created_time > info_min_time AND created_time < info_max_time OR info_max_time="+Infinity" 
 | stats count by created_time 
 | sort created_time 
 | eval created_time= strftime(created_time,"%d-%b-%y")

Screenshots - https://imgur.com/a/1PX3S5s

0 Karma

woodcock
Esteemed Legend

The problem is probably that Splunk has changed the defualt for the Null values setting in the Format area of the timechart. The possible values are Gaps, Zero, and Connect. It looks like in one is using Zero and the other is using Connect. Try the other values for this setting.

0 Karma

woodcock
Esteemed Legend

If you would just like to drop the most-recent time-window which may be partial because of event latency, you can just add this to your search:

... | reverse | streamstats count AS _order | where _order = 1 | reverse | fields - _order
0 Karma

woodcock
Esteemed Legend

You can either add this to the bottom:

... | where count>0

Or this:

... | eval count=if(count>0, count, null())

Lastly, you need to decide how to visualize the holes so click on the format tool, select the General tab and try the different options for Null values

praphulla1
Path Finder

the output of my query doesn't contain any events with =0. Let me try the options in format tool and get back to you.

0 Karma

woodcock
Esteemed Legend

If there are no values with 0 then what in the world are you talking about?

0 Karma

praphulla1
Path Finder

Did you see the pictures i posted. if you compare the graph you can see that in 7.x it plots the 0 on time-chart making it look continuous(day 1, 2, 3,4,5,6,7,8,9) vs 6.x where it is non-continuous (day 1,2,5,8,9). Assume day 3,4,6,7 are 0.

0 Karma

Sukisen1981
Champion

screenshot?

0 Karma

praphulla1
Path Finder
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...