topic Re: Timechart question in Splunk Search

Timechart question

bgill0123 — Fri, 06 Apr 2018 14:38:20 GMT

I am currently running this search:

index=events host=hig1* or host=hig2* | timechart span-1d dc(host)

the search works and I get the results I need however is there a way to list out all hosts and still get the count?

thanks

Re: Timechart question

mayurr98 — Fri, 06 Apr 2018 14:45:34 GMT

Try this

index=events host=hig1* OR host=hig2* | timechart span=1d dc(host) values(host)

let me know if this helps!

Re: Timechart question

DalJeanis — Fri, 06 Apr 2018 15:41:19 GMT

1) OR should be capitalized. 2) span=1d

I don't see how it would work, visually, to show a count and also the names in a single viz panel. Seems like you might want a line chart or bar chart for the dc, and then have a different viz for the names. Like, for instance, build a popup using JS so that when you hover over a particular day, it gets the list of unique names for that day.