topic Re: Put the time a the top of a timechart in Splunk Search

Put the time a the top of a timechart

Alaza — Tue, 29 Sep 2020 18:23:28 GMT

Hello,
How can I have a table like the picture with the time a the top, the type on the right side and a count by date on the row ?
With timechart It doesn't work :

index="Ico_number" Type_Group
| timechart count by Type_Group

Re: Put the time a the top of a timechart

tiagofbmm — Thu, 08 Mar 2018 15:59:51 GMT

Try this and adjust to your case

index=_internal 
| bucket _time span=1h 
| chart count by source, _time 
| addtotals

Re: Put the time a the top of a timechart

gcusello — Thu, 08 Mar 2018 16:00:19 GMT

Hi Alaza,
only few additional information to better understand your needs:

What's "Type_Group" a field or a string to search?
why do you say that timechart isn't running? don't you receive events or do they aren't correctly organized?
did you used span?

From your picture I see that you haven't weekends, you can filter results putting date_wday!=sunday OR date_waday!=saturday in your main search.
In other words, try something like this

index="Ico_number" date_wday!=sunday OR date_waday!=saturday
| timechart span=1d count by Type_Group

Bye.
Giuseppe

Re: Put the time a the top of a timechart

Alaza — Thu, 08 Mar 2018 16:09:20 GMT

Type_Group is a field and I can't display the value like the picture, weekend or not.

Re: Put the time a the top of a timechart

gcusello — Tue, 29 Sep 2020 18:23:35 GMT

Ok this probably is the reason because your search doesn't run, if you put a field in a search you have to assign a value, something like this

index="Ico_number" Type_Group=*

otherwise Splunk interpretes "Type_Group" as a string to search.
So try something like this
index="Ico_number" Type_Group=*
| timechart span=1d count by Type_Group
Bye.
Giuseppe

Re: Put the time a the top of a timechart

Alaza — Fri, 09 Mar 2018 08:42:07 GMT

Thanks for your help, it works now.