Chained search not working with chart command

Available Languages

Updated:September 29, 2026
Document ID:SPLK048281

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Cloud Splunk Enterprise

Description

When creating a chained search with the chart command, the chained search seems to be defaulting only to 1 hour time window even if the time window is set to 24 hours in global range of the dashboard. 


Investigation

Investigating the issue there is a transform statement needed to be able to have the chained search with chart command in a time window range, by default the time window range is 1 hour.  


Resolution

In Splunk, when dealing with transforms.conf settings, the time window for searches can't be directly controlled. However, if using chained searches in dashboards and experiencing issues where the time window defaults to 1 hour, the issue often stems from how the time constraints are passed or overridden in the search definitions. To resolve this follow the next step:
 
Ensure the time picker is properly configured:
If using a dashboard with a time picker, make sure the token for the time picker  ($time$) is being passed correctly to the chained search.

Adjust the earliest and latest in the base search or search macro:

If using a transforms.conf entry to define search macros or regular expressions for field extraction, it may inadvertently override or fix the time constraints. For example:

[your-transform-name]
REGEX = your_regex_pattern
FORMAT = $1::$2

Transforms.conf

 

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products

Related Articles