https://community.splunk.com/t5/Splunk-Search/Error-with-timechart-command/m-p/337343#M100069 <P>@mahbs, as @mmodestino has pointed out timechart should have <CODE>span=1m</CODE> not <CODE>span=avg("CPU")</CODE>, please try out the following query:</P> <PRE><CODE>source="xxx.log" host="xxxl" index="xxx" sourcetype="xxx" earliest=$source_tok$ latest=$End_Date$ | eval ReportKey="Yesterday" |timechart span=1m avg("CPU") by ReportKey </CODE></PRE> <P>Refer to Splunk documentation and try and understand how <CODE>timechart</CODE> command works: <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart</A></P> Mon, 30 Oct 2017 10:45:16 GMT niketn 2017-10-30T10:45:16Z https://community.splunk.com/t5/Splunk-Search/Error-with-timechart-command/m-p/337336#M100062 <P>Hi,</P> <P>I'm having a bit of trouble with this query of mine. </P> <PRE><CODE>source="xxx" host="xxx" index="xxx" sourcetype="xxx" earliest=-1d@d latest=-0d@d | eval ReportKey="Yesterday"|timechart span= 1m avg("CPU") by ReportKey </CODE></PRE> <P>This is the error I'm getting:</P> <P>"Error in 'timechart' command: The specifier '1m' is invalid. It must be in form (). For example: max(size)."</P> Sun, 29 Oct 2017 22:00:05 GMT https://community.splunk.com/t5/Splunk-Search/Error-with-timechart-command/m-p/337336#M100062 mahbs 2017-10-29T22:00:05Z https://community.splunk.com/t5/Splunk-Search/Error-with-timechart-command/m-p/337337#M100063 <P>try removing the space from your timechart command?</P> <P><CODE>..| timechart span=1m avg(CPU) by ReportKey</CODE></P> Sun, 29 Oct 2017 22:56:09 GMT https://community.splunk.com/t5/Splunk-Search/Error-with-timechart-command/m-p/337337#M100063 mattymo 2017-10-29T22:56:09Z https://community.splunk.com/t5/Splunk-Search/Error-with-timechart-command/m-p/337338#M100064 <P>Unfortunately it's not working. Im getting this error message now: The specifier '1m' is invalid. It must be in form (). For example: max(size)</P> Sun, 29 Oct 2017 22:59:29 GMT https://community.splunk.com/t5/Splunk-Search/Error-with-timechart-command/m-p/337338#M100064 mahbs 2017-10-29T22:59:29Z https://community.splunk.com/t5/Splunk-Search/Error-with-timechart-command/m-p/337339#M100065 <P>can you post your updated search?</P> Mon, 30 Oct 2017 00:15:31 GMT https://community.splunk.com/t5/Splunk-Search/Error-with-timechart-command/m-p/337339#M100065 mattymo 2017-10-30T00:15:31Z https://community.splunk.com/t5/Splunk-Search/Error-with-timechart-command/m-p/337340#M100066 <P>Your exmaple search seems ok. Just remove space, like.. <CODE>span= 1m</CODE> to <CODE>span=1m</CODE></P> <P>source="xxx.log" host="xxxl" index="xxx" sourcetype="xxx" earliest=$source_tok$ latest=$End_Date$ | eval ReportKey="Yesterday" |timechart span=1m avg("CPU") by ReportKey</P> Tue, 29 Sep 2020 16:30:42 GMT https://community.splunk.com/t5/Splunk-Search/Error-with-timechart-command/m-p/337340#M100066 kamlesh_vaghela 2020-09-29T16:30:42Z https://community.splunk.com/t5/Splunk-Search/Error-with-timechart-command/m-p/337341#M100067 <P>yep, It's:</P> <P>source="xxx.log" host="xxxl" index="xxx" sourcetype="xxx" earliest=$source_tok$ latest=$End_Date$ | eval ReportKey="Yesterday" |timechart span=avg("CPU") by ReportKey</P> <P>I closed the space between the timespace and the pipe</P> Tue, 29 Sep 2020 16:30:50 GMT https://community.splunk.com/t5/Splunk-Search/Error-with-timechart-command/m-p/337341#M100067 mahbs 2020-09-29T16:30:50Z https://community.splunk.com/t5/Splunk-Search/Error-with-timechart-command/m-p/337342#M100068 <P>I should add, the message I''m getting now is: </P> <P>Error in 'timechart' command: You must specify data field(s) to chart.</P> Mon, 30 Oct 2017 09:36:26 GMT https://community.splunk.com/t5/Splunk-Search/Error-with-timechart-command/m-p/337342#M100068 mahbs 2017-10-30T09:36:26Z https://community.splunk.com/t5/Splunk-Search/Error-with-timechart-command/m-p/337343#M100069 <P>@mahbs, as @mmodestino has pointed out timechart should have <CODE>span=1m</CODE> not <CODE>span=avg("CPU")</CODE>, please try out the following query:</P> <PRE><CODE>source="xxx.log" host="xxxl" index="xxx" sourcetype="xxx" earliest=$source_tok$ latest=$End_Date$ | eval ReportKey="Yesterday" |timechart span=1m avg("CPU") by ReportKey </CODE></PRE> <P>Refer to Splunk documentation and try and understand how <CODE>timechart</CODE> command works: <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart</A></P> Mon, 30 Oct 2017 10:45:16 GMT https://community.splunk.com/t5/Splunk-Search/Error-with-timechart-command/m-p/337343#M100069 niketn 2017-10-30T10:45:16Z https://community.splunk.com/t5/Splunk-Search/Error-with-timechart-command/m-p/337344#M100070 <P>yeah, still got typos there. </P> <P><CODE>| timechart span=1m avg("CPU") by ReportKey</CODE> Or you can leave span out and let Splunk automagically do it <CODE>| timechart avg("CPU") by ReportKey</CODE> </P> <P>definitely check out the docs link below for syntax and examples!</P> Mon, 30 Oct 2017 12:25:11 GMT https://community.splunk.com/t5/Splunk-Search/Error-with-timechart-command/m-p/337344#M100070 mattymo 2017-10-30T12:25:11Z