topic Using span option in timechart doesn't show any values in Getting Data In

Using span option in timechart doesn't show any values

4uramana4u — Wed, 25 Nov 2020 03:49:36 GMT

I am trying to get a time difference of two events and using timechart, I wants to display MAX(time difference value ) in a span of 30seconds; Below query is working with table and I want to use timechart - Any help appreciated.

index=express_its_pds_solsup_dce sourcetype="express:dce:shipmentlog" "EWPX - WCO: Begin saving"
| rex field=_raw "build.(?<SHIP_FILE>[\S+]*)"
| stats latest(_time) as begin_time by SHIP_FILE
| join SHIP_FILE
[ search index=express_its_pds_solsup_dce sourcetype="express:dce:shipmentlog" "EWPX - WCO: End"
| rex field=_raw "build.(?<SHIP_FILE>[\S+]*)"
| stats latest(_time) as end_time by SHIP_FILE ] | eval ship_throughput = end_time-begin_time

| table SHIP_FILE, ship_throughput

Re: Using span option in timechart doesn't show any values

thambisetty — Wed, 25 Nov 2020 06:00:03 GMT

@4uramana4u

streamstats is the best option to find out difference between two events. Below is the sample working query. you can tailor it as per your needs.

index=_internal sourcetype=splunkd host="samplehost" component=StatusMgr | bin _time span=30s | stats count by _time source | streamstats range(_time) as delta window=2 global=f by source | eventstats max(delta) as max_delta

Re: Using span option in timechart doesn't show any values

4uramana4u — Fri, 15 Jan 2021 07:46:37 GMT

Thank you, solved.