topic using a different time base on timechart in Splunk Search

using a different time base on timechart

fk319 — Fri, 10 Dec 2010 01:24:19 GMT

I would like to use a different field than _time as my time base for timechart.

I build a stats table, and in it I use "max(_time) as EndTime", after this point, I lose the value of _time and cannot use timechart. If I use chart, then the missing times get squashed out. What I would like to do, is after the stats command, use timechart with a the new compute "_time".

Re: using a different time base on timechart

gkanapathy — Fri, 10 Dec 2010 03:10:41 GMT

Just don't use timechart and use chart instead. timechart f(x) by y is basically the same as chart f(x) by _time,y, so just use that with a different field instead of _time. And generally

... | timechart span=s f(x) by y

is the same as

... | chart f(x) _time span=s, y

Alternatively, you could just use max(_time) as _time in your query.

Re: using a different time base on timechart

fk319 — Sat, 11 Dec 2010 00:33:23 GMT

Chart does not fill in the empty '_time' values, so the holes in the data gets dropped out and the data is squashed.

Re: using a different time base on timechart

gkanapathy — Sat, 11 Dec 2010 02:52:14 GMT

Use the makecontinuous command on the field before piping to chart