topic Re: timechart in Splunk Search

timechart

mm12 — Fri, 26 Nov 2021 17:22:47 GMT

Hi,

I am just taking the total count of incident using stats command form the json and the query is working fine. But when I using timechart command it is not giving me the visualization. Please anyone help me on this.

index=incident_index source="/mi_data/dc_in_events.json" | spath path=Incident__Number output=INC | stats values(*) as * by INC | stats count(Incident__Number)

Thanks

Re: timechart

PickleRick — Fri, 26 Nov 2021 18:52:57 GMT

How are you trying to add timechart to this search?

You're already doing stats and getting a single number so there is nothing to make timechart from.

BTW, you calculate stats values(*) but then only use one of those fields. Instead of doing all this, just doing

| stats dc(Incident_Number)

Instead of both stats would be enough.

About the timechart - it's not clear what you want to do. Can you explain it?

Re: timechart

mm12 — Fri, 26 Nov 2021 21:15:42 GMT

@PickleRick - I am using below query for time chart instead of stats command but it is not working.

index=incident_index source="/mi_data/dc_in_events.json" | spath path=Incident__Number output=INC | stats values(*) as * by INC | timechart count

Thanks

Re: timechart

PickleRick — Fri, 26 Nov 2021 22:11:05 GMT

Well, if you do your stats, you lose the _time field because you're aggregating data over values of INC. You might have a multivalued field containing all values of _time in one row but that's just one row, so there's no basis for timechart.

What do you want to chart? Tell us with your own words, not with SPL.