topic Timechart trend over the same interval as the search range in Splunk Search

Timechart trend over the same interval as the search range

epacke — Thu, 30 Aug 2018 14:30:08 GMT

Hi!

I have a scenario where we have used "| stats count" and gotten the total number for the range that we picked. This has been working fine, but now, we'd like to use timechart to get trends.

However, when using timechart, the number becomes the latest "bucket" instead of the total number.

Example:
Searching with a time range of 60 minutes would give me the value for the last minute.

Been fiddling around with some suggestions but haven't found a reliable solution. This last one:

| timechart [search index=_internal | head 1 | addinfo | eval timerange= info_max_time-info_min_time | eval span=if(round(timerange/3600) == infinity, 1, round(timerange/3600))."h"  | return span] count | appendpipe [stats count | where count=0]

It generates errors like "Error in timechart command. The value for option span (infinityh) is invalid."

Any ideas of what I'm doing wrong?

/Patrik

Re: Timechart trend over the same interval as the search range

skoelpin — Thu, 30 Aug 2018 16:11:24 GMT

Timechart is going to give you a new row for each bucket. Why use timechart if you don't want seperate buckets? Why use head 1 to return the latest bucket? If you were sold on using timechart then you would have to force it to use a single bucket by adding span=60m which would give you identical results of using stats

These 2 queries will give identical results

| bin _time span=60m
| stats count by _time 



| timechart span=60m count

Re: Timechart trend over the same interval as the search range

epacke — Fri, 31 Aug 2018 05:41:52 GMT

Timechart is used because I want the trend. Span=60m works but since I have a time picker this would not work for longer search ranges.