https://community.splunk.com/t5/Splunk-Search/timechart-function-issue/m-p/309635#M92889 <P>Awesome mate..<BR /> Thank you somuch..worked perfectly</P> Wed, 24 May 2017 05:34:35 GMT prathapkcsc 2017-05-24T05:34:35Z https://community.splunk.com/t5/Splunk-Search/timechart-function-issue/m-p/309633#M92887 <P>Hi everyone,<BR /> my query look like this <BR /> base search | reg " " | | bin _time as desired_times span=4h<BR /> | table _time server CPU MEM DISK raw1 raw2 </P> <P>This query working perfectly, giving desired results.<BR /> But after adding "| timechart max(DISK) as DISK by server" , its giving me all servers except two servers, meanwhile it was giving me the new column named as "OTHERS" which is not existed in my data.<BR /> Can anyone explain about this?</P> Tue, 29 Sep 2020 14:11:18 GMT https://community.splunk.com/t5/Splunk-Search/timechart-function-issue/m-p/309633#M92887 prathapkcsc 2020-09-29T14:11:18Z https://community.splunk.com/t5/Splunk-Search/timechart-function-issue/m-p/309634#M92888 <P>You need to use the limit attribute and all the servers would be listed -<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Timechart">http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Timechart</A></P> <PRE><CODE>| timechart limit=0 max(DISK) as DISK by server </CODE></PRE> Wed, 24 May 2017 05:30:57 GMT https://community.splunk.com/t5/Splunk-Search/timechart-function-issue/m-p/309634#M92888 dineshraj9 2017-05-24T05:30:57Z https://community.splunk.com/t5/Splunk-Search/timechart-function-issue/m-p/309635#M92889 <P>Awesome mate..<BR /> Thank you somuch..worked perfectly</P> Wed, 24 May 2017 05:34:35 GMT https://community.splunk.com/t5/Splunk-Search/timechart-function-issue/m-p/309635#M92889 prathapkcsc 2017-05-24T05:34:35Z https://community.splunk.com/t5/Splunk-Search/timechart-function-issue/m-p/309636#M92890 <P>base search | reg " " | | bin _time as desired_times span=4h | | where _time = desired_times<BR /> | table _time server CPU MEM DISK raw1 raw2.</P> <P>In where_time=desired_times,<BR /> my desired timings are 8AM,12PM,18PM.<BR /> How to give all 3 timings in that where clause</P> Tue, 29 Sep 2020 14:11:20 GMT https://community.splunk.com/t5/Splunk-Search/timechart-function-issue/m-p/309636#M92890 prathapkcsc 2020-09-29T14:11:20Z https://community.splunk.com/t5/Splunk-Search/timechart-function-issue/m-p/309637#M92891 <P>If you are wanting to search for events only during these hours, then use the date_hour field before the table command.</P> <PRE><CODE>| search date_hour=8 OR date_hour=12 OR date_hour=18 </CODE></PRE> <P>To get events during these hours.</P> Wed, 24 May 2017 06:49:05 GMT https://community.splunk.com/t5/Splunk-Search/timechart-function-issue/m-p/309637#M92891 dineshraj9 2017-05-24T06:49:05Z