topic Re: timechart does not dis play the error in Splunk Search

timechart does not dis play the error

splunkpoornima — Thu, 22 Nov 2012 07:34:57 GMT

hi all ,

I used the below query ..but i am not getting the timechart its shows

field '_time' should have numerical values

i have used the tonumber and auto function ..still i am getting error

Thanks

Poornima

Re: timechart does not dis play the error

Ayn — Thu, 22 Nov 2012 09:28:06 GMT

What's the idea of having the table command there?! That's what's causing your error. table will implicitly convert the _time value to something humanly readable, which is incompatible with what timechart expects.

Re: timechart does not dis play the error

splunkpoornima — Thu, 22 Nov 2012 09:46:24 GMT

hi ayn,

i tried without using the table command also but again it shows the same error as above

Re: timechart does not dis play the error

Ayn — Thu, 22 Nov 2012 09:48:15 GMT

Well what is the output of the saved search?

Re: timechart does not dis play the error

splunkpoornima — Thu, 22 Nov 2012 09:58:03 GMT

savedsearch -searchduration has the query

source="taskmanager_log.txt"|transaction TaskBP startswith=START endswith=Succeeded

savedsearch -searchavgduration has the query

source="task.txt"| transaction TaskBP startswith=START endswith=Succeeded|stats avg(duration) as Avgduration by TaskBP

Re: timechart does not dis play the error

Ayn — Thu, 22 Nov 2012 10:00:23 GMT

There you go - your stats at the end of the second saved search will remove the _time field altogether.

Re: timechart does not dis play the error

Drainy — Thu, 22 Nov 2012 11:50:40 GMT

Splunkpoornima, please please please stop reposting questions, let it flow and grow within the one question! http://splunk-base.splunk.com/answers/66695/timechart-errror It just confuses things if others search for answers in the future and people trying to help won't know what you've already been told!