https://community.splunk.com/t5/Splunk-Search/How-to-display-and-group-events-in-a-timechart-that-are/m-p/203641#M59160 <P>yes they are , these are spikes in the Total Errors and authorization and authentication failures respectively .</P> Thu, 04 Aug 2016 03:20:37 GMT kartik13 2016-08-04T03:20:37Z https://community.splunk.com/t5/Splunk-Search/How-to-display-and-group-events-in-a-timechart-that-are/m-p/203639#M59158 <P>Hi , </P> <P>I have a timechart with different columns. I want to display those events from a time chart which are continuous at least for 10 minutes.</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1672iBFDA775E1BB9AB0D/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>I want to group the events which are marked red and yellow on based on the time or event. Help required. </P> Wed, 03 Aug 2016 07:08:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-and-group-events-in-a-timechart-that-are/m-p/203639#M59158 kartik13 2016-08-03T07:08:57Z https://community.splunk.com/t5/Splunk-Search/How-to-display-and-group-events-in-a-timechart-that-are/m-p/203640#M59159 <P>Are the column names fixed in your time chart?</P> Wed, 03 Aug 2016 21:19:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-and-group-events-in-a-timechart-that-are/m-p/203640#M59159 somesoni2 2016-08-03T21:19:07Z https://community.splunk.com/t5/Splunk-Search/How-to-display-and-group-events-in-a-timechart-that-are/m-p/203641#M59160 <P>yes they are , these are spikes in the Total Errors and authorization and authentication failures respectively .</P> Thu, 04 Aug 2016 03:20:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-and-group-events-in-a-timechart-that-are/m-p/203641#M59160 kartik13 2016-08-04T03:20:37Z https://community.splunk.com/t5/Splunk-Search/How-to-display-and-group-events-in-a-timechart-that-are/m-p/203642#M59161 <P>Give this a shot (check the field names)</P> <PRE><CODE>your current search with timechart | streamstats current=f windows=1 values('Total Error') as prev_error values('Total Auth') as prev_auth | where (prev_error='Total Error' AND 'Total Error'!=0) OR (prev_auth='Total Auth' AND 'Total Auth'!=0) </CODE></PRE> Thu, 04 Aug 2016 03:29:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-and-group-events-in-a-timechart-that-are/m-p/203642#M59161 somesoni2 2016-08-04T03:29:09Z