How do I change the encoding section for Timecharts

[blackcatx13]

Hello everyone, 

I have been reading the documentation for timecharts however I am a bit confused on how I can modify the encoding for the timecharts to return the second column instead of the first  as shown in the image or here

I want to use a single value time chart to monitor the hosts reporting to me per hour and track the number of increase / decrease in them 

Many thanks for all your help 🙂

[isoutamo]

Hi

I’m not sure if I got what you are trying. Timechart with single value visualizations take always the last value (in your case count) and check what it was on previous span and then shows the trend. If you want that span is one hour then just add “timechart span=1h count” to your SPL.

r. Ismo