I want to create a graph that graphs the hits of the 5 minute interval with the maximum hits on that day. I also want to split this up by a field called MethodName:
Something like
source:__ | timechart count as hits span=5m | timechart max(hits)
That is the graph I need, but I need to split this by the field: "MethodName"
Any suggestions?
Here's an approach that looks like it should work, using Splunk's internal data as an example:
index=_internal
| bucket span=1m _time
| stats count by _time,source
| timechart span=1d max(count) by source
Here's an approach that looks like it should work, using Splunk's internal data as an example:
index=_internal
| bucket span=1m _time
| stats count by _time,source
| timechart span=1d max(count) by source
Worked perfectly thanks!