topic Re: Create timechart without a field name in Dashboards & Visualizations

Create timechart without a field name

123michi19 — Wed, 24 Jun 2020 18:42:48 GMT

Hi @ all,

how could I create a timechart if I have just a error message and no field value?

For example:
index="*" thisistheerrormessage | timechart thisistheerrormessage span=1h

Thanks and BR,
Michael

Re: Create timechart without a field name

efavreau — Thu, 05 Mar 2020 14:14:47 GMT

@123michi19 Count the events and chart when those event happened over time like this:
index="*" thisistheerrormessage | timechart span=1h count

Re: Create timechart without a field name

123michi19 — Thu, 05 Mar 2020 14:20:27 GMT

Thanks for your answer. That works fine. The only problem for me is: I see as describer in the timechart the word "count". How can I get the error message instead of count?

Re: Create timechart without a field name

niketn — Thu, 05 Mar 2020 14:29:00 GMT

Try the following:

| timechart span=1h count as "thisistheerrormessage"

Re: Create timechart without a field name

123michi19 — Thu, 05 Mar 2020 14:33:13 GMT

Yes, that's fantastic.
Thanks both for your help 🙂

Re: Create timechart without a field name

niketn — Thu, 05 Mar 2020 15:03:07 GMT

Anytime 🙂