https://community.splunk.com/t5/Splunk-Search/Display-data-in-timechart/m-p/493222#M137569 <P>@kirrusk did you try the above query? Does it work for you?</P> Thu, 19 Mar 2020 16:30:03 GMT niketn 2020-03-19T16:30:03Z https://community.splunk.com/t5/Splunk-Search/Display-data-in-timechart/m-p/493218#M137565 <P>I'm using summary index to get data and display in timechart. but not able to create a time chart with the data.</P> <P>index = summary_dm search_name = Instance_count | table total_Instancecount _time</P> <P>(total_Instancecount, _time) these are the two fields </P> <P>summary in is created by using<BR /> index = application cf_org = cf_space = cf_app = instance_index = |bucket _time span=1min| dedup cf_org cf_space cf_app instance_index | timechart span=1min count(instance_index) by cf_app| addtotals fieldname = Total_instances | fields _time Total_instances</P> <P>report is scheduled using above query</P> <P>summary index is populated with _time total_Instancecount.</P> Wed, 30 Sep 2020 04:35:33 GMT https://community.splunk.com/t5/Splunk-Search/Display-data-in-timechart/m-p/493218#M137565 kirrusk 2020-09-30T04:35:33Z https://community.splunk.com/t5/Splunk-Search/Display-data-in-timechart/m-p/493219#M137566 <P>@kirrusk what is the frequency of your summary indexing? Also how is summary index being created? For plotting timechart what is the span you are looking for</P> <PRE><CODE>index = summary_dm search_name = Instance_count | timechart sum(total_Instancecount) as total_Instancecount </CODE></PRE> Thu, 19 Mar 2020 08:45:41 GMT https://community.splunk.com/t5/Splunk-Search/Display-data-in-timechart/m-p/493219#M137566 niketn 2020-03-19T08:45:41Z https://community.splunk.com/t5/Splunk-Search/Display-data-in-timechart/m-p/493220#M137567 <P>summary in is created by using <BR /> index = application cf_org = * cf_space = * cf_app = * instance_index = * |bucket _time span=1min| dedup cf_org cf_space cf_app instance_index | timechart span=1min count(instance_index) by cf_app| addtotals fieldname = Total_instances | fields _time Total_instances</P> <P>report is scheduled using above query</P> <P>summary index is populated with _time Total_instances. </P> Wed, 30 Sep 2020 04:35:36 GMT https://community.splunk.com/t5/Splunk-Search/Display-data-in-timechart/m-p/493220#M137567 kirrusk 2020-09-30T04:35:36Z https://community.splunk.com/t5/Splunk-Search/Display-data-in-timechart/m-p/493221#M137568 <P>Try this:</P> <PRE><CODE> index = summary_dm search_name = Instance_count | timechart sum(Total_instances) AS Total_instances </CODE></PRE> Thu, 19 Mar 2020 16:28:47 GMT https://community.splunk.com/t5/Splunk-Search/Display-data-in-timechart/m-p/493221#M137568 woodcock 2020-03-19T16:28:47Z https://community.splunk.com/t5/Splunk-Search/Display-data-in-timechart/m-p/493222#M137569 <P>@kirrusk did you try the above query? Does it work for you?</P> Thu, 19 Mar 2020 16:30:03 GMT https://community.splunk.com/t5/Splunk-Search/Display-data-in-timechart/m-p/493222#M137569 niketn 2020-03-19T16:30:03Z