https://community.splunk.com/t5/Splunk-Search/Help-with-Timechart-command/m-p/615248#M213814 <P>timechart requires the _time field being in the dataset sent to it.&nbsp;</P><P>That field doesn't exist once you do :</P><PRE>| stats avg(ttt) as avg_ttt</PRE><P>&nbsp;</P><P>You also cant chart a string value. Your `uptime2String()` macro means you no longer have a value that can be compared in a chart.&nbsp;<BR /><BR /></P> Thu, 29 Sep 2022 16:52:09 GMT andrew_nelson 2022-09-29T16:52:09Z https://community.splunk.com/t5/Splunk-Search/Help-with-Timechart-command/m-p/615243#M213812 <P>I have an SPL which gives a result. I want to get a trend of the result.&nbsp;</P><P>So I tried using timechart command, but it is not working.&nbsp;</P><P>&nbsp;</P><P>Query</P><LI-CODE lang="markup">| tstats `summariesonly` earliest(_time) as _time from datamodel=Incident_Management.Notable_Events_Meta by source,Notable_Events_Meta.rule_id | `drop_dm_object_name("Notable_Events_Meta")` | `get_correlations` | join rule_id [| from inputlookup:incident_review_lookup | eval _time=time | stats earliest(_time) as review_time by rule_id] | eval ttt=review_time-_time | stats avg(ttt) as avg_ttt | sort - avg_ttt | `uptime2string(avg_ttt, avg_ttt)` | rename *_ttt* as *(Time_To_Triage)* | fields - *_dec |table avg(Time_To_Triage) |rename avg(Time_To_Triage) as "Mean/Average Time To Respond"</LI-CODE><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="alexspunkshell_0-1664468944627.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/21774iAC536505551073DC/image-size/medium?v=v2&amp;px=400" role="button" title="alexspunkshell_0-1664468944627.png" alt="alexspunkshell_0-1664468944627.png" /></span></P><P>&nbsp;</P> Thu, 29 Sep 2022 16:29:20 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-Timechart-command/m-p/615243#M213812 alexspunkshell 2022-09-29T16:29:20Z https://community.splunk.com/t5/Splunk-Search/Help-with-Timechart-command/m-p/615248#M213814 <P>timechart requires the _time field being in the dataset sent to it.&nbsp;</P><P>That field doesn't exist once you do :</P><PRE>| stats avg(ttt) as avg_ttt</PRE><P>&nbsp;</P><P>You also cant chart a string value. Your `uptime2String()` macro means you no longer have a value that can be compared in a chart.&nbsp;<BR /><BR /></P> Thu, 29 Sep 2022 16:52:09 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-Timechart-command/m-p/615248#M213814 andrew_nelson 2022-09-29T16:52:09Z https://community.splunk.com/t5/Splunk-Search/Help-with-Timechart-command/m-p/615474#M213892 <P>If you want to use timechart, your _time cannot be a single value such as earliest(_time) will give. (Besides, min(_time) is more efficient than earliest(_time).) &nbsp;With tstats, you need to chop off _time the same way you want timechart to chop off time into intervals. &nbsp;Say, you want to have 5-minute intervals,</P><LI-CODE lang="markup">| tstats `summariesonly` from datamodel=Incident_Management.Notable_Events_Meta by source,Notable_Events_Meta.rule_id _time span=5m | `drop_dm_object_name("Notable_Events_Meta")` | `get_correlations` | join rule_id [| from inputlookup:incident_review_lookup | eval _time=time | stats earliest(_time) as review_time by rule_id] | eval ttt=review_time-_time | timechart span=5m avg(ttt) as avg_ttt | sort - avg_ttt | `uptime2string(avg_ttt, avg_ttt)` | rename *_ttt* as *(Time_To_Triage)* | fields - *_dec | table avg(Time_To_Triage) | rename avg(Time_To_Triage) as "Mean/Average Time To Respond"</LI-CODE> Sat, 01 Oct 2022 01:22:44 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-Timechart-command/m-p/615474#M213892 yuanliu 2022-10-01T01:22:44Z