Create timechart without a field name

[123michi19]

Hi @ all,

how could I create a timechart if I have just a error message and no field value?

For example:
index="*" thisistheerrormessage | timechart thisistheerrormessage span=1h

Thanks and BR,
Michael

[efavreau · Accepted solution]

@123michi19 Count the events and chart when those event happened over time like this:
index="*" thisistheerrormessage | timechart span=1h count

[123michi19]

Thanks for your answer. That works fine. The only problem for me is: I see as describer in the timechart the word "count". How can I get the error message instead of count?

BR

[niketn]

Try the following:

| timechart span=1h count as "thisistheerrormessage"

[123michi19]

Yes, that's fantastic.
Thanks both for your help 🙂

[niketn]

Anytime 🙂