<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: adding timespan brings no results in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/adding-timespan-brings-no-results/m-p/87715#M18215</link>
    <description>&lt;P&gt;Thanks just got back, put that in and worked.&lt;/P&gt;</description>
    <pubDate>Mon, 02 Jul 2012 19:16:01 GMT</pubDate>
    <dc:creator>lancealotx</dc:creator>
    <dc:date>2012-07-02T19:16:01Z</dc:date>
    <item>
      <title>adding timespan brings no results</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/adding-timespan-brings-no-results/m-p/87713#M18213</link>
      <description>&lt;P&gt;I had a simple report showing the past 7 day's (by day) not per hour using the  timechart span="86400s" function.  The whole string looks like this;&lt;/P&gt;

&lt;P&gt;&lt;STRONG&gt;memberLevel="x" AND ApiKey = "123" OR ApiKey = "456" OR ApiKey = "789" OR ApiKey = "123456 | timechart span="86400s" count&lt;/STRONG&gt;&lt;/P&gt;

&lt;P&gt;That gives a nice chart report by day.  Now I want to chart each on the same chart, maybe a stacked one, so wrote this;&lt;/P&gt;

&lt;P&gt;*&lt;EM&gt;memberLevel="x" AND ApiKey = "123" OR ApiKey = "456" OR ApiKey = "789" OR ApiKey = "123456 | timechart span="86400s" count | stats count BY ApiKey  *&lt;/EM&gt;&lt;/P&gt;

&lt;P&gt;Now that 2nd one is what I want as it breaks out the counts by each ApiKey but it's back in an hourly chart.  I tried adding the timechart span everywhere but get the error &lt;EM&gt;Error in 'stats' command: The argument 'span=86400s' is invalid.&lt;/EM&gt; so not sure how to make that above chart to be what I want which would be a stacked chart broken by apikey.&lt;/P&gt;

&lt;P&gt;I have removed my other 'basic' noob questions since I found the user guide and did the tutorials, and getting the hang, just stuck on this.  I'm sure I can find, but if you can also say how to change the legend names as the current says just count.  &lt;/P&gt;

&lt;P&gt;Thanks.&lt;/P&gt;</description>
      <pubDate>Sat, 30 Jun 2012 02:11:19 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/adding-timespan-brings-no-results/m-p/87713#M18213</guid>
      <dc:creator>lancealotx</dc:creator>
      <dc:date>2012-06-30T02:11:19Z</dc:date>
    </item>
    <item>
      <title>Re: adding timespan brings no results</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/adding-timespan-brings-no-results/m-p/87714#M18214</link>
      <description>&lt;P&gt;Try...&lt;/P&gt;

&lt;P&gt;memberLevel="x" AND ApiKey = "123" OR ApiKey = "456" OR ApiKey = "789" OR ApiKey = "123456 | timechart span=1d count by ApiKey&lt;/P&gt;</description>
      <pubDate>Sat, 30 Jun 2012 02:48:12 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/adding-timespan-brings-no-results/m-p/87714#M18214</guid>
      <dc:creator>farleymike</dc:creator>
      <dc:date>2012-06-30T02:48:12Z</dc:date>
    </item>
    <item>
      <title>Re: adding timespan brings no results</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/adding-timespan-brings-no-results/m-p/87715#M18215</link>
      <description>&lt;P&gt;Thanks just got back, put that in and worked.&lt;/P&gt;</description>
      <pubDate>Mon, 02 Jul 2012 19:16:01 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/adding-timespan-brings-no-results/m-p/87715#M18215</guid>
      <dc:creator>lancealotx</dc:creator>
      <dc:date>2012-07-02T19:16:01Z</dc:date>
    </item>
  </channel>
</rss>

