Splunk Search

Gap in chart data

Ant1D
Motivator

Hi,

I have a chart that is produced by executing a search with a | timechart command.

As the search is executing, you can see the chart cells appear as shown in the following image:
alt text

But once the search above is finished the following gap appears in the chart data:
alt text

This search has just over 150000 matching events in total. Is this gap appearing because a search limit is being exceeded? How can I stop this from happening?

Help would be much appreciated. Thanks in advance.

0 Karma
1 Solution

fox
Path Finder

This can be resolved by restructuring the search. Simply add a stats command stage to help the timechart command on it's way. It fixes the issue.

View solution in original post

0 Karma

fox
Path Finder

This can be resolved by restructuring the search. Simply add a stats command stage to help the timechart command on it's way. It fixes the issue.

0 Karma

sloshburch
Splunk Employee
Splunk Employee

Are you proposing using both stats and timechart?

For example a search like this is showing gaps for me as well (but searches with smaller time windows show the data does exist and can be generated by timechart)
_some_base_search | timechart span=1d perc90(field)

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...