Splunk Search

Passing span as argument to timechart

keerthana_k
Communicator

Hi
I have a requirement wherein I have to display 3 different series in a single chart. I am using an append query to fetch all the results and manipulating the search job in my dashboard.xml. I also have a dropdown at the top to select time ranges. Based on the time ranges selected, my timechart's span should also vary ex. for last 60 minutes, the span should be 5 minutes and so on. When I pass the span value dynamically, I am getting an error saying "Invalid Option". Please tell me how this can be done.

Tags (2)

martin_mueller
SplunkTrust
SplunkTrust

In that case you can hack yourself to dynamic spans like this:

index=_internal | timechart count [stats count | addinfo | eval range = info_max_time - info_min_time | eval span = "span=".case(range < 4000, "5m", range < 90000, "1h", 1=1, "12h") | return $span]

The subsearch probably is best put into a macro.

keerthana_k
Communicator

I tried this but I keep getting the error: SearchException: This search cannot be parsed when parse_only is set to true. Any help with this?

helge
Builder

Works great!

0 Karma

keerthana_k
Communicator

I have hard coded it for now. I cannot use fixed bins as my time ranges vary greatly. They are Last 60 minutes, Last 24 hours and Last 7 days.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

How are you passing the span now?

Have you considered specifying a fixed maximum number of bins instead?

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...