https://community.splunk.com/t5/Splunk-Search/How-to-use-stats-range-time-and-pass-the-results-to-timechart/m-p/356950#M105592 <P>This works, I was hoping to avoid keeping these times saved and use the range command. Looks like that is not that straight forward. Thanks for the quick response, I was able to get the results I was looking for.</P> Sun, 24 Dec 2017 16:05:18 GMT mkatta 2017-12-24T16:05:18Z https://community.splunk.com/t5/Splunk-Search/How-to-use-stats-range-time-and-pass-the-results-to-timechart/m-p/356948#M105590 <P>I have data where every line has a timestamp and a correlationID. I can find the time elapsed for each correlation ID using the following query.</P> <P>index=yyy sourcetype=mysource CorrelationID=* | stats range(_time) as timeperCID by CorrelationID, date_hour | stats count avg(timeperCID) as ATC by date_hour | sort num(date_hour)</P> <P>I want to use timechart and timewrap on this data to be able to eventually get a week over week comparison of the output. I tried adding a timechart at the end but it does not return any results.</P> <P>1) index=yyy sourcetype=mysource CorrelationID=* | stats range(_time) as timeperCID by CorrelationID, date_hour | stats count avg(timeperCID) as ATC by date_hour | sort num(date_hour) | timechart values(ATC)</P> <P>2) index=yyy sourcetype=mysource CorrelationID=* | stats range(_time) as timeperCID by CorrelationID, date_hour | timechart count avg(timeperCID) as ATC </P> <P>I've also tried to add a _time value or recreate it using the strptime before the timechart with no luck. </P> <P>Please help</P> Tue, 29 Sep 2020 17:21:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-stats-range-time-and-pass-the-results-to-timechart/m-p/356948#M105590 mkatta 2020-09-29T17:21:58Z https://community.splunk.com/t5/Splunk-Search/How-to-use-stats-range-time-and-pass-the-results-to-timechart/m-p/356949#M105591 <P>@mkatta, from code provided in the question seems like you are trying to find the duration of a transaction based on CorrelationID and then plot the average duration of all transactions on the timechart.</P> <PRE><CODE>index=yyy sourcetype=mysource CorrelationID=* | stats count as eventCount earliest(_time) as earliestTime latest(_time) as latestTime by CorrelationID | eval duration=latestTime-earliestTime | search eventCount&gt;1 | eval _time=earliestTime | timechart span=1d avg(duration) as avgDuration | fillnull value=0 avgDuration | eval avgDuration=round(avgDuration,1) | timewrap 1week | fillnull value=0 </CODE></PRE> Sun, 24 Dec 2017 15:33:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-stats-range-time-and-pass-the-results-to-timechart/m-p/356949#M105591 niketn 2017-12-24T15:33:08Z https://community.splunk.com/t5/Splunk-Search/How-to-use-stats-range-time-and-pass-the-results-to-timechart/m-p/356950#M105592 <P>This works, I was hoping to avoid keeping these times saved and use the range command. Looks like that is not that straight forward. Thanks for the quick response, I was able to get the results I was looking for.</P> Sun, 24 Dec 2017 16:05:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-stats-range-time-and-pass-the-results-to-timechart/m-p/356950#M105592 mkatta 2017-12-24T16:05:18Z