topic Help needed Timechart Query in Splunk Search

Help needed Timechart Query

Macky_29 — Thu, 26 Jan 2023 20:10:25 GMT

Dear experts ,

I am searching on my bot index, which contain conve-id and rest of the fields are stored as payload. Using spath i am able to extract required fields from payload into a table , now for trend analysis i want to use time chart command to see number of users per month , however its not working , below is the query for your reference , need help with the query :

index=idx_chatbot logpoint=response-in AND service="journeyService" OR service="watsonPostMessage" |spath input=payload output=displayname path=context.displayName | spath input=payload output=Country path=context.countryCode | spath input=payload output=Intent path=intents{}.intent |spath input=payload output=ticketResponse path=response.createTicketResponse.Message | table conversation-id timestamp service duration logpoint userFeedback displayname text Country Intent category ticketResponse payload | dedup conversation-id | timechart span=1mon count(displayName)

Re: Help needed Timechart Query

richgalloway — Thu, 26 Jan 2023 20:12:27 GMT

"Its not working" gives us nothing to work with. Help us help you by explaining what the expected results are and what you are getting from the current query.

Re: Help needed Timechart Query

Macky_29 — Fri, 27 Jan 2023 05:07:15 GMT

@richgalloway

It doesn't give any result , below is the screenshot

I am expecting it gives me monthly count (trend)of distinct display name i.e. users in my case.

Re: Help needed Timechart Query

Macky_29 — Fri, 27 Jan 2023 05:09:15 GMT

Re: Help needed Timechart Query

bowesmana — Fri, 27 Jan 2023 05:25:24 GMT

You can't do a timechart without the _time field and your table command effectively removes the _time field

Also, not sure why your timechart is count(displayName) as that is counting occurrences of that field in all the deduped conversation-id events - so unless it is blank in some events, it will be a 1:1 relationship with conversation-id.

It would seem that you are looking to count the number of individual conversations, so you would get this by replacing your last 3 lines with

| timechart span=1mon dc(conversation-id)

but if you are looking for distinct displayName then you can still replace the last 3 lines with

| timechart span=1mon dc(displayName)

unless you have have many _different_ displayName values for a single conversation-id

Re: Help needed Timechart Query

Macky_29 — Fri, 27 Jan 2023 05:50:04 GMT

Thanks Bowesmana it works 😊