topic Re: How do you use the stats command on a timechart output? in Splunk Dev

How do you use the stats command on a timechart output?

asharm65 — Tue, 29 Sep 2020 22:24:48 GMT

Hi,

i wanted to calculate a count for every 1 sec period and then find the max of the count per day.

i have calculated the count using timechart function.Using query below:

1)..base_query|timechart span=1s count(field_1) as c by field_2

The output of the above query gives a count every 1 second.

Now to calculate the max of count per day. i tried using stats:

2)..base_query|timechart span=1s count(field_1) as c by field_2|stats max(c) by Date

But, the 2nd query does not give desired output.

Thanks in Advance!!!

FrankVl — Mon, 17 Dec 2018 10:24:18 GMT

Where do you get that by Date from? That Date field doesn't exist (at least not given the exact query you are showing here).

If you want to get the max per-second-count by day, try it like this:

...base_query
| timechart span=1s count(field_1) as c by field_2
| bin _time span=1d
| stats max(c) by _time

asharm65 — Wed, 19 Dec 2018 11:48:45 GMT

This does not give any output

FrankVl — Wed, 19 Dec 2018 12:02:04 GMT

Can you share the actual search you are running which doesn't give output and / or a screenshot of the situation?