topic Re: Timechart by field in tabular format in Splunk Search

Timechart by field in tabular format

pankajad — Sun, 27 Jun 2021 06:06:31 GMT

There are 100s of APIs in my application. I'm logging exception for an API. I can get stats to get total no of exception in a time window by using

Exception |stats count by uri

This will give me result in tabular format exception count for each uri.

However, I would like to get this data in timechart for each uri. This can easily be done if I hardcode the uri and get exception count on time series but I don't want to do this for 100s of APIs.

| timechart count by api puts many under OTHER and NULL category. However, I would want api as row and time as column..preferably in visual format - timechart against each api

Re: Timechart by field in tabular format

ITWhisperer — Sat, 26 Jun 2021 23:06:00 GMT

Exception | timechart count by uri

Re: Timechart by field in tabular format

pankajad — Sun, 27 Jun 2021 06:07:42 GMT

I had tried timechart but it doesn't solver my issue. I have updated my question with more details

Re: Timechart by field in tabular format

kamlesh_vaghela — Sun, 27 Jun 2021 07:20:07 GMT

@pankajad

Can you please try something like this?

uri=* Exception | timechart usenull=f useother=f count by uri