topic Re: How to plot a timechart from a stats search output with span=1m? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-plot-a-timechart-from-a-stats-search-output-with-span-1m/m-p/133801#M36566 <P>You must make sure to have a <CODE>_time</CODE> field available after the stats or the timechart will fail, do as I said or do as @somesoni2 said <span class="lia-unicode-emoji" title=":winking_face:">😉</span> </P> Tue, 25 Nov 2014 19:58:53 GMT MuS 2014-11-25T19:58:53Z How to plot a timechart from a stats search output with span=1m? https://community.splunk.com/t5/Splunk-Search/How-to-plot-a-timechart-from-a-stats-search-output-with-span-1m/m-p/133797#M36562 <P>After doing transaction, removing unique row and finally applying </P> <P>| stats list(score) as score, list(Id) as Id by Type</P> <P>gave me following result, can someone tell me a way to plot this as timechart span=1m avg(Score) by Type this command doesn't plot any data </P> <PRE><CODE>Type Score A 123 786 45 B 34 95 </CODE></PRE> Tue, 25 Nov 2014 18:39:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-plot-a-timechart-from-a-stats-search-output-with-span-1m/m-p/133797#M36562 MayankSplunk 2014-11-25T18:39:19Z Re: How to plot a timechart from a stats search output with span=1m? https://community.splunk.com/t5/Splunk-Search/How-to-plot-a-timechart-from-a-stats-search-output-with-span-1m/m-p/133798#M36563 <P>Hi MayankSplunk,</P> <P>after the stats you don't have <CODE>_time</CODE> available for timechart, so do something like this:</P> <PRE><CODE>| stats list(score) as score, list(Id) as Id by Type, _time | timechart .... </CODE></PRE> <P>cheers, MuS</P> Tue, 25 Nov 2014 19:06:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-plot-a-timechart-from-a-stats-search-output-with-span-1m/m-p/133798#M36563 MuS 2014-11-25T19:06:20Z Re: How to plot a timechart from a stats search output with span=1m? https://community.splunk.com/t5/Splunk-Search/How-to-plot-a-timechart-from-a-stats-search-output-with-span-1m/m-p/133799#M36564 <P>Hi MuS,</P> <P>Sorry that din't work. </P> Tue, 25 Nov 2014 19:26:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-plot-a-timechart-from-a-stats-search-output-with-span-1m/m-p/133799#M36564 MayankSplunk 2014-11-25T19:26:17Z Re: How to plot a timechart from a stats search output with span=1m? https://community.splunk.com/t5/Splunk-Search/How-to-plot-a-timechart-from-a-stats-search-output-with-span-1m/m-p/133800#M36565 <P>Try this <BR /> If you want avg of all values of score for a Type, including duplicates (two entries with same score and Type)</P> <PRE><CODE>your base search ..before your stats | timechart span=1m avg(score) by Type </CODE></PRE> <P>OR<BR /> If you want avg of only unique values of score for a Type, excludingduplicates</P> <PRE><CODE>your base search ..before your stats | bucket span=1m _time | stats count by score, type, _time | timechart span=1m avg(score) by Type </CODE></PRE> Tue, 25 Nov 2014 19:30:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-plot-a-timechart-from-a-stats-search-output-with-span-1m/m-p/133800#M36565 somesoni2 2014-11-25T19:30:59Z Re: How to plot a timechart from a stats search output with span=1m? https://community.splunk.com/t5/Splunk-Search/How-to-plot-a-timechart-from-a-stats-search-output-with-span-1m/m-p/133801#M36566 <P>You must make sure to have a <CODE>_time</CODE> field available after the stats or the timechart will fail, do as I said or do as @somesoni2 said <span class="lia-unicode-emoji" title=":winking_face:">😉</span> </P> Tue, 25 Nov 2014 19:58:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-plot-a-timechart-from-a-stats-search-output-with-span-1m/m-p/133801#M36566 MuS 2014-11-25T19:58:53Z