topic Re: help to display min and max in a timechart in Splunk Search

How to display min and max in a timechart?

jip31 — Wed, 02 Mar 2022 20:20:01 GMT

hello

I use this timechart

index=tutu sourcetype=titi | timechart span=15min dc(s) as "Uniq"

Now i would like to display 2 more lines with min and max for "s" field

is it possible

Re: help to display min and max in a timechart

tshah-splunk — Wed, 02 Mar 2022 10:27:02 GMT

Hey @jip31,

Along with the dc function, you can also use the min() and max() functions to fetch the minimum and maximum value of the field respectively. Your query should look something like below

index=tutu sourcetype=titi | timechart span=15min dc(s) as "Uniq" min(s) as s_min max(s) as s_max

Re: help to display min and max in a timechart

ITWhisperer — Wed, 02 Mar 2022 10:30:09 GMT

Try this:

| timechart dc(value) as unique min(value) as min_s max(value) as max_s span=15m

Re: help to display min and max in a timechart

jip31 — Wed, 02 Mar 2022 10:34:09 GMT

it's exactly what I done and I have no results...

Re: help to display min and max in a timechart

jip31 — Wed, 02 Mar 2022 10:36:00 GMT

it's exactly what I done and I have no results...

i have just results with

| timechart dc(value) as unique

Re: help to display min and max in a timechart

ITWhisperer — Wed, 02 Mar 2022 10:42:41 GMT

Sounds like there is something different about your data or setup, because this is the way to do what you asked. Can you share more details and a screenshot of your results?

Re: help to display min and max in a timechart

jip31 — Wed, 02 Mar 2022 11:09:02 GMT

if i just run

| timechart span=15min dc(s) as "Nb"

I have results

but if I run

| timechart span=15min dc(s) as "Nb" min(s) as min, max(s) as max

I have any results

Re: help to display min and max in a timechart

PickleRick — Wed, 02 Mar 2022 11:14:57 GMT

Verify that the field you're trying to calculate max and min on are numeric fields.

With simple stats max() and min() on text field would give you results (although it would be calculated based on lexicographic order) but timechart will return empty result of such aggregation.

Re: help to display min and max in a timechart

ITWhisperer — Wed, 02 Mar 2022 11:17:24 GMT

Do you get anything if you just do min?

| timechart span=15min min(s) as min

Re: help to display min and max in a timechart

jip31 — Wed, 02 Mar 2022 11:19:05 GMT

Re: help to display min and max in a timechart

jip31 — Wed, 02 Mar 2022 11:22:19 GMT

your are right

"s" field is not numeric

when I am doing dc(s) , i count the number of "s" fields so it works but for min and max because its not numeric it doesnt works of course