topic How to do a timechart from a single panel result? in Splunk Search

How to do a timechart from a single panel result?

jip31 — Wed, 27 Apr 2022 16:01:58 GMT

I need to do a timechart from a single panel result

In this single panel, I stats events like this

| stats count as PbPerf by s | search PbPerf>10 | stats dc(s)

The results of this search is 14 events

Now I need to timechart these 14 events

So I am doing this

| bin _time span=1d | stats count as PbPerf by s _time | search PbPerf>10 | timechart count span=1h

The first problem I have is that I want to retrieve the 14 events before doing the timechart is that I have to use a span=1d

But of course all the 14 events are grouped with the same _time even if I use a span=1h in the timechart

So how to display a timechart that display a _time value for my 14 events?

Thanks

Re: help on timechart

gcusello — Wed, 27 Apr 2022 10:49:46 GMT

Hi @jip31,

at first, why don't you directly use timechart in you search?

| timechart span=1d count as PbPerf by s | where PbPerf>10

but anyway, you cannot use before span=1d and then span=1h, because you have the same hour in each date for each day.

Ciao.

Giuseppe

Re: help on timechart

jip31 — Wed, 27 Apr 2022 11:04:14 GMT

Your idea is not bad but :

1) the where condition works only if I delete "by s"

2) if I timechart by s, I have only ten results for s

Re: help on timechart

gcusello — Wed, 27 Apr 2022 11:07:29 GMT

Hi @jip31,

this isn't a problem od the search but of your data, maybe you should use a different threshold.

When you say 14 results are you speking of two weeks or what else?

Ciao.

Giuseppe

Re: help on timechart

jip31 — Wed, 27 Apr 2022 13:27:32 GMT

it's 14 events

Re: help on timechart

gcusello — Wed, 27 Apr 2022 14:03:37 GMT

Hi @jip31,

as I said, if using the BY clause probably you should better analyze your data to understand if the results you're waiting are correct.

Ciao.

Giuseppe

Re: help on timechart

gcusello — Wed, 27 Apr 2022 14:44:49 GMT

Hi @jip31,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉