https://community.splunk.com/t5/Splunk-Search/why-timechart-is-not-working-in-this-query/m-p/399639#M115849 <P>Hi @richgalloway But one problem with this new query... Now it is giving the sum of fails only in the earliest hour (ie. has the sum of all the 5 hours), all the ther rows have tie stamp for each hour but the sum of Fails is null against them.. Can you please suggest what should I use instead of min(_time) in stats?</P> Wed, 17 Jul 2019 17:46:46 GMT amaurya1 2019-07-17T17:46:46Z https://community.splunk.com/t5/Splunk-Search/why-timechart-is-not-working-in-this-query/m-p/399636#M115846 <P>index=abc sourcetype=xyz earliest=-65h latest=-61h<BR /> |stats count as Fail by school<BR /> |where like (school, "%public%")<BR /> |timechart span=1h sum(Fail) as Fail</P> <P>I want to get the sum of fails per hour but I don't know why it is showing "no result" as the output. If I use stats instead of timechart (stats sum(Fail) as Fail), then it gives me the total sum of fails but since I want per hour count therefore I wanted to have timechart in the query.<BR /> Can someone please help?</P> Wed, 17 Jul 2019 17:19:03 GMT https://community.splunk.com/t5/Splunk-Search/why-timechart-is-not-working-in-this-query/m-p/399636#M115846 amaurya1 2019-07-17T17:19:03Z https://community.splunk.com/t5/Splunk-Search/why-timechart-is-not-working-in-this-query/m-p/399637#M115847 <P>The <CODE>stats</CODE> command filters out all fields except those used in its arguments so there is no _time field for <CODE>timechart</CODE> to use.</P> <P>Try this query</P> <PRE><CODE>index=abc sourcetype=abc school="*public*" | bin span=1h _time |stats count as Fail by _time host | timechart span=1h sum(Fail) as Fail </CODE></PRE> Wed, 17 Jul 2019 17:31:22 GMT https://community.splunk.com/t5/Splunk-Search/why-timechart-is-not-working-in-this-query/m-p/399637#M115847 richgalloway 2019-07-17T17:31:22Z https://community.splunk.com/t5/Splunk-Search/why-timechart-is-not-working-in-this-query/m-p/399638#M115848 <P>Hi @richgalloway thanks for your answer.. yes you are correct, the first stats comment removed the time field. I've update the query and now it's working fine. </P> <P>index=abc sourcetype=xyz earliest=-65h latest=-61h<BR /> |stats min(_time) as _time, count as Fail by school<BR /> |where like (school, "%public%")<BR /> |timechart span=1h sum(Fail) as Fail</P> Wed, 17 Jul 2019 17:38:19 GMT https://community.splunk.com/t5/Splunk-Search/why-timechart-is-not-working-in-this-query/m-p/399638#M115848 amaurya1 2019-07-17T17:38:19Z https://community.splunk.com/t5/Splunk-Search/why-timechart-is-not-working-in-this-query/m-p/399639#M115849 <P>Hi @richgalloway But one problem with this new query... Now it is giving the sum of fails only in the earliest hour (ie. has the sum of all the 5 hours), all the ther rows have tie stamp for each hour but the sum of Fails is null against them.. Can you please suggest what should I use instead of min(_time) in stats?</P> Wed, 17 Jul 2019 17:46:46 GMT https://community.splunk.com/t5/Splunk-Search/why-timechart-is-not-working-in-this-query/m-p/399639#M115849 amaurya1 2019-07-17T17:46:46Z https://community.splunk.com/t5/Splunk-Search/why-timechart-is-not-working-in-this-query/m-p/399640#M115850 <P>Have you tried my query?</P> Wed, 17 Jul 2019 23:32:24 GMT https://community.splunk.com/t5/Splunk-Search/why-timechart-is-not-working-in-this-query/m-p/399640#M115850 richgalloway 2019-07-17T23:32:24Z https://community.splunk.com/t5/Splunk-Search/why-timechart-is-not-working-in-this-query/m-p/399641#M115851 <P>Yeah.. I tried that one and it's working fine.. I'll use yours.. thanks</P> Thu, 18 Jul 2019 16:08:24 GMT https://community.splunk.com/t5/Splunk-Search/why-timechart-is-not-working-in-this-query/m-p/399641#M115851 amaurya1 2019-07-18T16:08:24Z