https://community.splunk.com/t5/Splunk-Search/tstat-and-timechart/m-p/95281#M182455 <P>tscollect was leveraged to put data into time series index files. I am able to use tstat to calculate statistics. How would I go about leveraging timechart with tstat?</P> <P>Here is what I want to work:<BR /> | tstats prestats=t field1, field2, field3 FROM my_ns | timechart avg(field1) by field2</P> <P>What am I missing?</P> <P>Thanks,<BR /> Joe</P> Mon, 15 Apr 2013 21:27:59 GMT rizzo75 2013-04-15T21:27:59Z https://community.splunk.com/t5/Splunk-Search/tstat-and-timechart/m-p/95281#M182455 <P>tscollect was leveraged to put data into time series index files. I am able to use tstat to calculate statistics. How would I go about leveraging timechart with tstat?</P> <P>Here is what I want to work:<BR /> | tstats prestats=t field1, field2, field3 FROM my_ns | timechart avg(field1) by field2</P> <P>What am I missing?</P> <P>Thanks,<BR /> Joe</P> Mon, 15 Apr 2013 21:27:59 GMT https://community.splunk.com/t5/Splunk-Search/tstat-and-timechart/m-p/95281#M182455 rizzo75 2013-04-15T21:27:59Z https://community.splunk.com/t5/Splunk-Search/tstat-and-timechart/m-p/95282#M182456 <P>Joe,<BR /> Try using this:</P> <PRE><CODE>| tstats prestats=t count as count FROM my_ns groupby field1,field2,field3,_time | timechart avg(field1) as field1_avg by field2 </CODE></PRE> Tue, 16 Apr 2013 18:49:19 GMT https://community.splunk.com/t5/Splunk-Search/tstat-and-timechart/m-p/95282#M182456 Lamar 2013-04-16T18:49:19Z