https://community.splunk.com/t5/Splunk-Search/Timechart-chart-for-getting-the-count-of-events-with-specified/m-p/349499#M170195 <P>the <CODE>timechart</CODE> needs the <CODE>_time</CODE> field, you are stripping it with your <CODE>stats</CODE> try to add it after the <CODE>by</CODE> clause<BR /> as a side note, no need to <CODE>rename</CODE> here and in general, try to do so (and other cosmetics) at the end of the query for better performance. lastly, the function is <CODE>values</CODE> not <CODE>value</CODE><BR /> try this:</P> <PRE><CODE>index=servers sourcetype=xs_json Name=web url=www.google.com/something | stats count(eval(dby.msg="HTTP Request Exceeded SLA")) as EXCEEDED count(eval(bdy.msg="HttpRequest")) as REQUEST by host _time | eval Ratio=EXCEEDED/REQUEST | timechart span=15m values(Ratio) by host </CODE></PRE> <P>hope it helps</P> Thu, 19 Apr 2018 03:03:09 GMT adonio 2018-04-19T03:03:09Z https://community.splunk.com/t5/Splunk-Search/Timechart-chart-for-getting-the-count-of-events-with-specified/m-p/349496#M170192 <P>Hi ,</P> <P>I want a graph which actually gives me a ratio of count of events by host grouped together in a 15 minute interval for last 24 hours.</P> <P>I have written a query like this <CODE>index=servers sourcetype=xs_json Name=web url=www.google.com/something | rename bdy.msg as msg | chart span=15m count(eval(msg="HTTP Request Exceeded SLA")) as EXCEEDED count(eval(msg="HttpRequest")) as REQUEST by host | eval Ratio=EXCEEDED/REQUEST | fields - EXCEEDED - REQUEST</CODE> </P> <P>This gives me a graph, but i want the bars(for each host) to be grouped together for every 15 minutes interval. Any thoughts?? </P> Wed, 18 Apr 2018 22:06:26 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-chart-for-getting-the-count-of-events-with-specified/m-p/349496#M170192 macadminrohit 2018-04-18T22:06:26Z https://community.splunk.com/t5/Splunk-Search/Timechart-chart-for-getting-the-count-of-events-with-specified/m-p/349497#M170193 <P>Please use trellis visualization to accomplish the requirement </P> Wed, 18 Apr 2018 23:15:55 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-chart-for-getting-the-count-of-events-with-specified/m-p/349497#M170193 ssadanala1 2018-04-18T23:15:55Z https://community.splunk.com/t5/Splunk-Search/Timechart-chart-for-getting-the-count-of-events-with-specified/m-p/349498#M170194 <P>I want time to be on X-axis and ratio on y-axis. with the above query I am getting host on x-axis and Ratio on y. </P> <P>Also when I use the below query it doesn't give any stats :</P> <PRE><CODE>index=servers sourcetype=xs_json Name=web url=www.google.com/something | rename bdy.msg as msg | stats count(eval(msg="HTTP Request Exceeded SLA")) as EXCEEDED count(eval(msg="HttpRequest")) as REQUEST by host | eval Ratio=EXCEEDED/REQUEST | fields - EXCEEDED - REQUEST | timechart value(Ratio) by host </CODE></PRE> Thu, 19 Apr 2018 01:07:06 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-chart-for-getting-the-count-of-events-with-specified/m-p/349498#M170194 macadminrohit 2018-04-19T01:07:06Z https://community.splunk.com/t5/Splunk-Search/Timechart-chart-for-getting-the-count-of-events-with-specified/m-p/349499#M170195 <P>the <CODE>timechart</CODE> needs the <CODE>_time</CODE> field, you are stripping it with your <CODE>stats</CODE> try to add it after the <CODE>by</CODE> clause<BR /> as a side note, no need to <CODE>rename</CODE> here and in general, try to do so (and other cosmetics) at the end of the query for better performance. lastly, the function is <CODE>values</CODE> not <CODE>value</CODE><BR /> try this:</P> <PRE><CODE>index=servers sourcetype=xs_json Name=web url=www.google.com/something | stats count(eval(dby.msg="HTTP Request Exceeded SLA")) as EXCEEDED count(eval(bdy.msg="HttpRequest")) as REQUEST by host _time | eval Ratio=EXCEEDED/REQUEST | timechart span=15m values(Ratio) by host </CODE></PRE> <P>hope it helps</P> Thu, 19 Apr 2018 03:03:09 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-chart-for-getting-the-count-of-events-with-specified/m-p/349499#M170195 adonio 2018-04-19T03:03:09Z