topic Re: tstats timechart in Splunk Search

tstats timechart

kunalmao — Thu, 12 Oct 2017 10:34:24 GMT

I am trying to do a time chart of available indexes in my environment , I already tried below query with no luck

| tstats count where index=* by index _time

but i want results in the same format as

index=* | timechart count by index limit=50

Re: tstats timechart

gcusello — Thu, 12 Oct 2017 10:44:36 GMT

Hi kunalmao,
why you want to use tstats if the second solution solves your needs?
If the problem is performance, use | metasearch before index=*
Bye.
Giuseppe

Re: tstats timechart

DEAD_BEEF — Tue, 11 Sep 2018 14:57:40 GMT

To add to this post for future readers, if you did want to use tstats, then you could using the following syntax:

| tstats count WHERE (index=*) BY index _time span=1d prestats=t 
| timechart span=1d count by index

adjust the span period (on both lines as they must match) to whatever you prefer based on your search (1h, 4h, 5m, etc...)

Re: tstats timechart

guarisma — Tue, 05 Jan 2021 18:42:10 GMT

I would do it by including _time in the tstats' by statement

| tstats count where index=* by _time index | timechart span=1mon sum(count) by index