https://community.splunk.com/t5/Splunk-Search/Unable-to-draw-timechart/m-p/393411#M190813 <P>Thank you so much ,it worked</P> Fri, 19 Jul 2019 23:57:17 GMT mayank101 2019-07-19T23:57:17Z https://community.splunk.com/t5/Splunk-Search/Unable-to-draw-timechart/m-p/393408#M190810 <P>I have a query that accumulates the total count for host over a 6 period of month. Now when I am trying to draw time chart for it ,I am unable to do so.It shows no result .<BR /> | savedsearch "r1" <BR /> | top 10 event by host | sort-count | eventstats sum(count) as TotalNumber| eval PercentOfTotal = round(100 * count / TotalNumber,2). "%"<BR /> | stats list(entity) as "Entity" list(count) as "Count", sum(count) as "Total" by event <BR /> | sort-Total<BR /><BR /> | addinfo <BR /> | eval rank=1 | accum rank | sort +num(rank) | head (rank &lt;=10) | fields rank, host,event, Entity, Count,Total | eval Entity=mvindex(Entity,0,9) <BR /> | eval Count=mvindex(Count,0,9) | eval Percent=mvindex(Percent,0,9)<BR /> |timechart span=1d useother=f count by host<BR /> Can you please help in drawing timechart</P> Fri, 19 Jul 2019 21:17:23 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-draw-timechart/m-p/393408#M190810 mayank101 2019-07-19T21:17:23Z https://community.splunk.com/t5/Splunk-Search/Unable-to-draw-timechart/m-p/393409#M190811 <P>Timechart requires _time in order to function, but your "stats" commands don't pass _time through. Assuming your saved search includes _time, try this:</P> <PRE><CODE>| savedsearch "r1" | bin _time span=1d | top 10 event by host, _time | sort-count | eventstats sum(count) as TotalNumber | eval PercentOfTotal = round(100 * count / TotalNumber,2). "%" | stats list(entity) as "Entity" list(count) as "Count", sum(count) as "Total" by event, _time | sort-Total | addinfo | eval rank=1 | accum rank | sort +num(rank) | head (rank &lt;=10) | fields rank, host,event, Entity, Count,Total | eval Entity=mvindex(Entity,0,9) | eval Count=mvindex(Count,0,9) | eval Percent=mvindex(Percent,0,9) | timechart span=1d useother=f count by host </CODE></PRE> <P>If your saved search has a different time field, then you may need to convert that to _time using strptime.</P> Fri, 19 Jul 2019 23:13:37 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-draw-timechart/m-p/393409#M190811 jlemley 2019-07-19T23:13:37Z https://community.splunk.com/t5/Splunk-Search/Unable-to-draw-timechart/m-p/393410#M190812 <P>Thank you so much ,it worked</P> Fri, 19 Jul 2019 23:56:49 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-draw-timechart/m-p/393410#M190812 mayank101 2019-07-19T23:56:49Z https://community.splunk.com/t5/Splunk-Search/Unable-to-draw-timechart/m-p/393411#M190813 <P>Thank you so much ,it worked</P> Fri, 19 Jul 2019 23:57:17 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-draw-timechart/m-p/393411#M190813 mayank101 2019-07-19T23:57:17Z https://community.splunk.com/t5/Splunk-Search/Unable-to-draw-timechart/m-p/393412#M190814 <P>Hey jlemley...The above command is not working, its not showing top10,its just listing alphabetically.</P> Wed, 24 Jul 2019 16:11:12 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-draw-timechart/m-p/393412#M190814 mayank101 2019-07-24T16:11:12Z