topic Re: timechart without spaning in Splunk Search

timechart without spaning

sbsbb — Mon, 28 Sep 2020 13:42:18 GMT

I would like to show the message_types from each event on a timeline.

I think timechart would be the right element, but is there a way to specify that it shoud not span ?

index=t | head 10 | timechart list(H_message_type) [[NOSPAN ?]]

gfuente — Wed, 10 Apr 2013 09:58:27 GMT

Hello

Have you tried just:

index=t | head 10 |   timechart count by H_message_type

Regards

sbsbb — Wed, 10 Apr 2013 10:47:28 GMT

splunk is still putting events together... _time difference is in ms...
I tried with span=1cs, but doesn't work :

[SimpleResultsTable module] invalid literal for int() with base 10: '0.01'

MuS — Mon, 28 Sep 2020 13:42:23 GMT

use this:

index=t | head 10 | timechart span=1ms list(H_message_type)

this should provide the correct chart .... at least it did for me with 5.0.1

cheers, MuS

jonuwz — Wed, 10 Apr 2013 16:31:29 GMT

you dont have to use timechart. xyseries can do it too, and you dont specify a span, or an aggregating function

i.e.

index=_internal group="per_sourcetype_thruput"  | xyseries _time series ev

if you dont have a series (a "by" clause - the 2nd arg to xyseries), you need to make a dummy one.

index=_internal | eval wibble="suasages" | xyseries _time wibble bytes