https://community.splunk.com/t5/Splunk-Search/What-does-the-quot-timechart-per-day-total-quot-do-in-the-Splunk/m-p/309158#M92729 <P>It’s doing the span for you as far as I can tell</P> Thu, 22 Feb 2018 22:58:44 GMT jkat54 2018-02-22T22:58:44Z https://community.splunk.com/t5/Splunk-Search/What-does-the-quot-timechart-per-day-total-quot-do-in-the-Splunk/m-p/309152#M92723 <P>I was reading the documentation on <CODE>per_day</CODE>, here: <A href="https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Timefunctions">https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Timefunctions</A></P> <P>In it, the first example is <CODE>timechart per_day(total)</CODE>. What does this do exactly? Does it count the number of events with the field <CODE>total</CODE> for each day, and so generate a single data point for each day (and then plot it versus time)?</P> Thu, 22 Feb 2018 21:30:17 GMT https://community.splunk.com/t5/Splunk-Search/What-does-the-quot-timechart-per-day-total-quot-do-in-the-Splunk/m-p/309152#M92723 flow2k 2018-02-22T21:30:17Z https://community.splunk.com/t5/Splunk-Search/What-does-the-quot-timechart-per-day-total-quot-do-in-the-Splunk/m-p/309153#M92724 <P>It’s the count of events with the field “total” bucketed per day.</P> Thu, 22 Feb 2018 22:05:30 GMT https://community.splunk.com/t5/Splunk-Search/What-does-the-quot-timechart-per-day-total-quot-do-in-the-Splunk/m-p/309153#M92724 jkat54 2018-02-22T22:05:30Z https://community.splunk.com/t5/Splunk-Search/What-does-the-quot-timechart-per-day-total-quot-do-in-the-Splunk/m-p/309154#M92725 <P>Okay, this is very clear. I don't know if it's just me, but the documentation's description "Returns the values of field X" sounds rather different - I was first led to believe somehow the value of the field <CODE>total</CODE> is of concern..when in fact the value doesn't matter at all, only the existence of the field matters.</P> Thu, 22 Feb 2018 22:08:20 GMT https://community.splunk.com/t5/Splunk-Search/What-does-the-quot-timechart-per-day-total-quot-do-in-the-Splunk/m-p/309154#M92725 flow2k 2018-02-22T22:08:20Z https://community.splunk.com/t5/Splunk-Search/What-does-the-quot-timechart-per-day-total-quot-do-in-the-Splunk/m-p/309155#M92726 <P>Wait, how come I see values like 0.0333? Isn't the count supposed to be an integer? Is some kind of division going on here?</P> Thu, 22 Feb 2018 22:12:11 GMT https://community.splunk.com/t5/Splunk-Search/What-does-the-quot-timechart-per-day-total-quot-do-in-the-Splunk/m-p/309155#M92726 flow2k 2018-02-22T22:12:11Z https://community.splunk.com/t5/Splunk-Search/What-does-the-quot-timechart-per-day-total-quot-do-in-the-Splunk/m-p/309156#M92727 <P>So if you have one view in 7 days, per day is 1/7</P> Thu, 22 Feb 2018 22:32:23 GMT https://community.splunk.com/t5/Splunk-Search/What-does-the-quot-timechart-per-day-total-quot-do-in-the-Splunk/m-p/309156#M92727 jkat54 2018-02-22T22:32:23Z https://community.splunk.com/t5/Splunk-Search/What-does-the-quot-timechart-per-day-total-quot-do-in-the-Splunk/m-p/309157#M92728 <P>I see...so the timechart <CODE>span</CODE> matters here.</P> Thu, 22 Feb 2018 22:39:33 GMT https://community.splunk.com/t5/Splunk-Search/What-does-the-quot-timechart-per-day-total-quot-do-in-the-Splunk/m-p/309157#M92728 flow2k 2018-02-22T22:39:33Z https://community.splunk.com/t5/Splunk-Search/What-does-the-quot-timechart-per-day-total-quot-do-in-the-Splunk/m-p/309158#M92729 <P>It’s doing the span for you as far as I can tell</P> Thu, 22 Feb 2018 22:58:44 GMT https://community.splunk.com/t5/Splunk-Search/What-does-the-quot-timechart-per-day-total-quot-do-in-the-Splunk/m-p/309158#M92729 jkat54 2018-02-22T22:58:44Z