topic Re: Why does timechart not work? in Splunk Search

Why does timechart not work?

Jaylon — Thu, 14 Apr 2022 16:18:45 GMT

timechart [stats count|eval app=$A$|eval search=case(app=="*","span=30m count by B",app!="*","span=30m count by C")] is not work after upgrading splunk from 8.0.6 to 8.2.5.

Re: Why does timechart not work?

tscroggins — Sat, 16 Apr 2022 19:00:12 GMT

@Jaylon

Can you provide more context? The search you provided isn't a functional standalone search in any version of Splunk.

Re: Why does timechart not work?

ITWhisperer — Sun, 17 Apr 2022 07:57:01 GMT

Something similar to this appears to work with 8.2.5 (and other versions). Please provide more details e.g. our dashboard SimpleXML as there may be something other than the timechart command not working.

Re: Why does timechart not work?

PickleRick — Sun, 17 Apr 2022 08:31:06 GMT

You already asked this question. https://community.splunk.com/t5/Splunk-Search/How-to-correct-timechart-after-upgrading/m-p/593883#M206713