https://community.splunk.com/t5/Splunk-Search/Help-with-time-chart-search-that-accumulates-total-count-over-6/m-p/394409#M114563 <P>I have a search that accumulates the total count for host over a 6 period of months. <BR /> Now when I am trying to draw a time chart for it, I am unable to do so.<BR /> It shows the result incorrectly- if it is showing one.<BR /> Could anyone help in correcting it?</P> <PRE><CODE>|savedsearch "r1" | bin _time span=6mon |top 10 host by event,_time | sort-count | eventstats sum(count) as TotalNumber| eval PercentOfTotal = round(100 * count / TotalNumber,2). "%" | stats list(entity) as "Entity" list(count) as "Count", sum(count) as "Total" by host ,_time | sort-Total | addinfo | eval rank=1 | accum rank | sort +num(rank) | head (rank &lt;=10) | fields rank, host,Count,Total | eval Entity=mvindex(Entity,0,9) | eval Count=mvindex(Count,0,9) | eval Percent=mvindex(Percent,0,9) | timechart span=1d useother=f count by host </CODE></PRE> Mon, 22 Jul 2019 17:04:45 GMT mayank101 2019-07-22T17:04:45Z https://community.splunk.com/t5/Splunk-Search/Help-with-time-chart-search-that-accumulates-total-count-over-6/m-p/394409#M114563 <P>I have a search that accumulates the total count for host over a 6 period of months. <BR /> Now when I am trying to draw a time chart for it, I am unable to do so.<BR /> It shows the result incorrectly- if it is showing one.<BR /> Could anyone help in correcting it?</P> <PRE><CODE>|savedsearch "r1" | bin _time span=6mon |top 10 host by event,_time | sort-count | eventstats sum(count) as TotalNumber| eval PercentOfTotal = round(100 * count / TotalNumber,2). "%" | stats list(entity) as "Entity" list(count) as "Count", sum(count) as "Total" by host ,_time | sort-Total | addinfo | eval rank=1 | accum rank | sort +num(rank) | head (rank &lt;=10) | fields rank, host,Count,Total | eval Entity=mvindex(Entity,0,9) | eval Count=mvindex(Count,0,9) | eval Percent=mvindex(Percent,0,9) | timechart span=1d useother=f count by host </CODE></PRE> Mon, 22 Jul 2019 17:04:45 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-time-chart-search-that-accumulates-total-count-over-6/m-p/394409#M114563 mayank101 2019-07-22T17:04:45Z