https://community.splunk.com/t5/Monitoring-Splunk/timechart-errror/m-p/41372#M6952 <P>hi all,</P> <P>i run this below query but it shows me error as</P> <P><STRONG>fiels"_time" Field '_time' should have numerical values.</STRONG></P> <P>source="C:\Users\20875\Desktop\taskmanager_log.txt" | transaction TaskBP startswith=START endswith=Succeeded | table TaskBP duration | join TaskBP [ | search source="C:\Users\20875\Desktop\task.txt"| transaction TaskBP startswith=START endswith=Succeeded|stats avg(duration) as Avgduration by TaskBP] | eval Diff=duration-Avgduration | table TaskBP Diff | where (Diff&gt;-100 AND Diff&lt;100) | timechart count(Diff) by TaskBP </P> <P>kindly help me to get rid of this error</P> <P>thanks in advance</P> <P>poornima</P> Mon, 28 Sep 2020 12:50:38 GMT splunkpoornima 2020-09-28T12:50:38Z https://community.splunk.com/t5/Monitoring-Splunk/timechart-errror/m-p/41372#M6952 <P>hi all,</P> <P>i run this below query but it shows me error as</P> <P><STRONG>fiels"_time" Field '_time' should have numerical values.</STRONG></P> <P>source="C:\Users\20875\Desktop\taskmanager_log.txt" | transaction TaskBP startswith=START endswith=Succeeded | table TaskBP duration | join TaskBP [ | search source="C:\Users\20875\Desktop\task.txt"| transaction TaskBP startswith=START endswith=Succeeded|stats avg(duration) as Avgduration by TaskBP] | eval Diff=duration-Avgduration | table TaskBP Diff | where (Diff&gt;-100 AND Diff&lt;100) | timechart count(Diff) by TaskBP </P> <P>kindly help me to get rid of this error</P> <P>thanks in advance</P> <P>poornima</P> Mon, 28 Sep 2020 12:50:38 GMT https://community.splunk.com/t5/Monitoring-Splunk/timechart-errror/m-p/41372#M6952 splunkpoornima 2020-09-28T12:50:38Z https://community.splunk.com/t5/Monitoring-Splunk/timechart-errror/m-p/41373#M6953 <P>Well, at a first guess without any testing you've removed the _time field by using the reporting command table to only pass those two fields.<BR /> Each time you pipe results over, reporting commands will only pass the fields you tell them to. Try adding _time to your commands and please please please read the tutorials</P> Wed, 21 Nov 2012 12:39:55 GMT https://community.splunk.com/t5/Monitoring-Splunk/timechart-errror/m-p/41373#M6953 Drainy 2012-11-21T12:39:55Z