https://community.splunk.com/t5/Splunk-Search/How-to-use-timechart-with-Eval-command/m-p/489788#M136805 <P>index=storage source="/******<EM>.csv" <BR /> | stats sum(00_</EM>) //It represents sum of various fields<BR /> | eval sum1=0 <BR /> | foreach sum* <BR /> [ eval sum1=sum1+'&lt;<FIELD>&gt;'] <BR /> | addinfo <BR /> | eval time_in_min=(info_max_time-info_min_time)/60 <BR /> | eval sum1=sum1/time_in_min //It shows the average value <BR /> | fields sum1</FIELD></P> <P>I need timechart for sum1 with above data, is it possible ? Any help would be appreciated.<BR /> Thanks in Advance</P> Wed, 30 Sep 2020 02:20:28 GMT shugup2923 2020-09-30T02:20:28Z https://community.splunk.com/t5/Splunk-Search/How-to-use-timechart-with-Eval-command/m-p/489788#M136805 <P>index=storage source="/******<EM>.csv" <BR /> | stats sum(00_</EM>) //It represents sum of various fields<BR /> | eval sum1=0 <BR /> | foreach sum* <BR /> [ eval sum1=sum1+'&lt;<FIELD>&gt;'] <BR /> | addinfo <BR /> | eval time_in_min=(info_max_time-info_min_time)/60 <BR /> | eval sum1=sum1/time_in_min //It shows the average value <BR /> | fields sum1</FIELD></P> <P>I need timechart for sum1 with above data, is it possible ? Any help would be appreciated.<BR /> Thanks in Advance</P> Wed, 30 Sep 2020 02:20:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-timechart-with-Eval-command/m-p/489788#M136805 shugup2923 2020-09-30T02:20:28Z https://community.splunk.com/t5/Splunk-Search/How-to-use-timechart-with-Eval-command/m-p/489789#M136806 <P>@shugup2923 </P> <P>Can you please share your search using <CODE>code</CODE> block?</P> Wed, 25 Sep 2019 12:00:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-timechart-with-Eval-command/m-p/489789#M136806 kamlesh_vaghela 2019-09-25T12:00:57Z https://community.splunk.com/t5/Splunk-Search/How-to-use-timechart-with-Eval-command/m-p/489790#M136807 <P>The problem lies with the <CODE>stats</CODE> and <CODE>fields</CODE> commands. They stripped out the <CODE>_time</CODE> field required by <CODE>timechart</CODE>. Use <CODE>streamstats</CODE> in place of <CODE>stats</CODE> or find a way to include _time in <CODE>stats</CODE>. Change <CODE>fields sum1</CODE> to <CODE>fields _time sum1</CODE>.</P> Wed, 25 Sep 2019 12:13:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-timechart-with-Eval-command/m-p/489790#M136807 richgalloway 2019-09-25T12:13:26Z