topic Re: Need help with Timechart command in Splunk Search

Need help with Timechart command

Anthonylucian — Thu, 01 Apr 2021 14:34:34 GMT

Hey all, so im trying to generate a time chart. If i perform the the stats command to validate the number of state I get the number im looking for with this query.

|stats latest(*) AS * by ip, pluginID
| dedup macAddress, Datacenter
| stats count(state) as Fixed by cve

So now I wanted to transform the count of state over to a timechart but when I do this I get no data at all.

|stats latest(*) AS * by ip, pluginID
| dedup macAddress, Datacenter
| timechart count(state) as Fixed by cve useother=false

Im pretty new to the timechart command, any help would be greatly appreciated!

Thanks!

Re: Need help with Timechart command

scelikok — Thu, 01 Apr 2021 14:40:31 GMT

Hi @Anthonylucian,

timechart need _time field to group by events. Your stats command does not output _time field on result set, that is why timechart cannot group and show the events. You can try below;

|stats latest(_time) as _time latest(*) AS * by ip, pluginID | dedup macAddress, Datacenter | timechart count(state) as Fixed by cve useother=false

Re: Need help with Timechart command

aasabatini — Thu, 01 Apr 2021 14:40:51 GMT

Hi @Anthonylucian

when you use stats comand you report only the fields reported on your search:

try to put state on stats comand like this

|stats latest(*) AS * by ip, pluginID,state,Fixed
| dedup macAddress, Datacenter
| timechart count(state) as Fixed by cve useother=false

or you can try like this

|stats latest(*) AS * values(state) as state, values(Fixed) as Fixed by ip, pluginID
| dedup macAddress, Datacenter
| timechart count(state) as Fixed by cve useother=false

Re: Need help with Timechart command

ITWhisperer — Thu, 01 Apr 2021 14:48:06 GMT

timechart needs the _time field to work with but the initial stats command does not pass this through

Re: Need help with Timechart command

Anthonylucian — Thu, 01 Apr 2021 14:50:09 GMT

Thank you!

You all are always so fast to reply!

Re: Need help with Timechart command

Anthonylucian — Thu, 01 Apr 2021 14:51:37 GMT

Didnt work for me, but thanks for the help!