https://community.splunk.com/t5/Splunk-Search/Adapting-a-search-to-use-timechart/m-p/347009#M170273 <P>Since you want to do timechart on calculated value after stats aggregation, you would need to do that aggregation for the time span you want to use in the timechart. E.g. If you want that RiskValueL to be calculated for every hour and show a timechart, you'd do something like this</P> <PRE><CODE>index=M sourcetype="n" name="M*" |dedup host-ip, plugin_name, plugin_family, severity, "ports{}.port", "ports{}.transport" | eval vulhost=if (severity="critical" or severity="high" or severity="medium" or severity="low",'host-ip',null()) | bucket span=1h _time | stats dc(host-ip) as TH, dc(vulhost) as VH, first(date_month) as ETime, count(eval(severity="critical")) as VH1, count(eval(severity="high")) as VH2, count(eval(severity="medium")) as VH3, count(eval(severity="low")) as VH4, count by _time | fillnull critical, high,medium,low,VH1,VH2,VH3,VH4 |eval RiskValueL=round((VH1+0.75*VH2+0.5*VH3+0.1*VH4)/(VH1+VH2+VH3+VH4)*(VH/TH),5) | timechart span=1h avg(RiskValueL) as RiskValueL </CODE></PRE> <P>Basically, bucket _time with 1hr spans before stats, add _time to stats and add timechart with same span.</P> Tue, 17 Apr 2018 18:42:53 GMT somesoni2 2018-04-17T18:42:53Z https://community.splunk.com/t5/Splunk-Search/Adapting-a-search-to-use-timechart/m-p/347007#M170271 <P>Hello:<BR /> I have the following search:</P> <PRE><CODE>index=M sourcetype="n" name="M*" |dedup host-ip, plugin_name, plugin_family, severity, "ports{}.port", "ports{}.transport" | eval vulhost=if (severity="critical" or severity="high" or severity="medium" or severity="low",'host-ip',null())| stats dc(host-ip) as TH, dc(vulhost) as VH, first(date_month) as ETime, count(eval(severity="critical")) as VH1, count(eval(severity="high")) as VH2, count(eval(severity="medium")) as VH3, count(eval(severity="low")) as VH4, count | fillnull critical, high,medium,low,VH1,VH2,VH3,VH4 |eval RiskValueL=round((VH1+0.75*VH2+0.5*VH3+0.1*VH4)/(VH1+VH2+VH3+VH4)*(VH/TH),5) </CODE></PRE> <P>I have to show a timechart with the RiskValue that is calculated in the search, however if I add the timechart at the end of the search, it shows nothing. How can I modify this search to be able to visualize a timechart of the RiskValue for the past 3 months for example?</P> Tue, 17 Apr 2018 17:10:12 GMT https://community.splunk.com/t5/Splunk-Search/Adapting-a-search-to-use-timechart/m-p/347007#M170271 atenciodeyka 2018-04-17T17:10:12Z https://community.splunk.com/t5/Splunk-Search/Adapting-a-search-to-use-timechart/m-p/347008#M170272 <P>the <CODE>stats</CODE> command takes the <CODE>_time</CODE> away ...<BR /> add <CODE>by _time</CODE> at the end of your <CODE>stats</CODE> and youll be fine</P> Tue, 17 Apr 2018 17:19:17 GMT https://community.splunk.com/t5/Splunk-Search/Adapting-a-search-to-use-timechart/m-p/347008#M170272 adonio 2018-04-17T17:19:17Z https://community.splunk.com/t5/Splunk-Search/Adapting-a-search-to-use-timechart/m-p/347009#M170273 <P>Since you want to do timechart on calculated value after stats aggregation, you would need to do that aggregation for the time span you want to use in the timechart. E.g. If you want that RiskValueL to be calculated for every hour and show a timechart, you'd do something like this</P> <PRE><CODE>index=M sourcetype="n" name="M*" |dedup host-ip, plugin_name, plugin_family, severity, "ports{}.port", "ports{}.transport" | eval vulhost=if (severity="critical" or severity="high" or severity="medium" or severity="low",'host-ip',null()) | bucket span=1h _time | stats dc(host-ip) as TH, dc(vulhost) as VH, first(date_month) as ETime, count(eval(severity="critical")) as VH1, count(eval(severity="high")) as VH2, count(eval(severity="medium")) as VH3, count(eval(severity="low")) as VH4, count by _time | fillnull critical, high,medium,low,VH1,VH2,VH3,VH4 |eval RiskValueL=round((VH1+0.75*VH2+0.5*VH3+0.1*VH4)/(VH1+VH2+VH3+VH4)*(VH/TH),5) | timechart span=1h avg(RiskValueL) as RiskValueL </CODE></PRE> <P>Basically, bucket _time with 1hr spans before stats, add _time to stats and add timechart with same span.</P> Tue, 17 Apr 2018 18:42:53 GMT https://community.splunk.com/t5/Splunk-Search/Adapting-a-search-to-use-timechart/m-p/347009#M170273 somesoni2 2018-04-17T18:42:53Z