(How) can I create an auto span timechart that has a subsecond minimum span, such as 0.001s?
### Background to this question
My dashboards show logs from systems that process many transactions per second. I have deliberately designed the dashboards to "work" regardless of the duration specified by the time picker. Timecharts "auto span": they automatically infer span from the data time range. (The X-axis of time-based charts automatically adjusts to match the duration.) These dashboards can be used to analyze logs across a wide variety of durations. In practice, users might initially be interested in a time range of several minutes, and then [zoom in][1] to analyze progressively narrower time ranges, down to subsecond time ranges.
As far as I can tell, the minimum span that you can specify in Splunk (6.6.3) is one second, `minspan=1s`. Smaller, subsecond values, such as `minspan=0.001s`, cause visualizations to display the error "Error in 'timechart' command: Invalid value for minspan".
Here, I am (re)developing in Splunk some dashboards that I have already developed in Kibana (5.5).
In Kibana, I can zoom time-based charts to a minimum span of 0.001s. For example, I can zoom so far in that buckets are marked on the X-axis as 14:34:45.242, 14:34:45.243, 14:34:45.244, etc.
In Splunk, the granularity "bottoms out" at 1 second; If I have a time range of 2 seconds, I'm looking at two buckets. Two fat bars. That's disappointing. Am I missing something? Can I somehow increase this granularity to match what I can do in Kibana?
[1]: https://answers.splunk.com/answers/568487
↧