topic Re: Create a time series graph after a stats command in Splunk Search

Create a time series graph after a stats command

jamesboustead — Wed, 06 Jan 2021 08:11:38 GMT

Hi,

I'm not able to create a timechart graph for the below search, it is coming up with no result.

My current search is as below:

"My search

| stats count by xxx

| xxx = xxx * count

| stats sum(xxx) as "yyy"

This search gives the the correct total but only relating to the time range picker, how would I manipulate the query to get a time series graph by the sum of each day?

Re: Create a time series graph after a stats command

saravanan90 — Wed, 06 Jan 2021 08:19:41 GMT

We can use timechart command.

index=_internal
| timechart span=1d count

Re: Create a time series graph after a stats command

scelikok — Wed, 06 Jan 2021 08:20:41 GMT

Hi @jamesboustead,

Since your search has no _time field on group by. "timechart" command use _time field for group by.

Please try below as a sample;

| timechart span=1d count by xxx | eval xxx = xxx * count | timechart span=1d sum(xxx) as yyy

If this reply helps you an upvote is appreciated.

Re: Create a time series graph after a stats command

jamesboustead — Wed, 06 Jan 2021 08:27:01 GMT

This is now giving me two columns:

- one for "_time" which is split up daily which is good.

- one for 'yyy' but unfortunately this has no values underneath the column.

Please can you advise on how to get the value underneath 'yyy' corresponding to each day in the '_time' column?

Thank you

Re: Create a time series graph after a stats command

scelikok — Wed, 06 Jan 2021 08:52:02 GMT

Since I don't know your data I tried to convert your search to timechart. I think xxx field is not a numeric field, so eval calculation is returning null value. I don't know your use case but below sample should work.

| timechart span=1d count by xxx | eval xxx = 5 * count | timechart span=1d sum(xxx) as yyy