Dashboards & Visualizations

How to create timechart for a stat count result for every single hour for date range selection?

wangkevin1029
Communicator

Hi,  Splunkers, 

 

I have dashboard ,which has a table ouput like  below:

| table _time, column1, column2, column3

time    column1 column2    column3
xxx      a                  1234           1234
xxx      b                  3243           3434
xxx      c                  2343           3434
xxx      a                  1234           1234
xxx      b                  3243           3434
xxx      a                   2343          3434


when I add  |stats count by column1:

| table column1, column2, column3 | stats count by column1

column1     count
a                      3
b                     2
c                     1


I want to have a chart to display this stats count result in different time period, when I select different time/date range,

like when I select 7 days, I want this stats count  columns1 result showing in every single hour for each day for 7 days date range I selected.

I am a splunk beginner, not sure if I describe my requirement clearly...😁

thx in advance.


Kevin

 

Labels (1)
0 Karma

wangkevin1029
Communicator

Sanjay, 

when just add  | stats count by VQ, I have correct statistics return as below:

wangkevin1029_1-1670423501773.png

 

wangkevin1029_0-1670423482882.png

 

0 Karma

wangkevin1029
Communicator

wangkevin1029_0-1670392661935.png

 

also expect to see this bar graph when event tab is selected. 

 

Kevin

0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

Hi @wangkevin1029 

can you try this
| timechart span=1h by column1

0 Karma

wangkevin1029
Communicator

SanjayReddy,

 

I tried  | table _time, column, column2, column3 | stats count by VQ | timechart span=1h count by VQ

or  

| table _time, column, column2, column3 | timechart span=1h count by VQ,   both has statistics tab  0.

 

but when I run  | table _time, column, column2, column3 | stats count by VQ, it has correct return.

 

Kevin

0 Karma

wangkevin1029
Communicator

SanjayReddy,

 

I tried  | table _time, column, column2, column3 | stats count by VQ | timechart span=1h count by VQ

or  

| table _time, column, column2, column3 | timechart span=1h count by VQ,   both has statistics tab  0.

 

but when I run  | table _time, column, column2, column3 | stats count by VQ, it has correct return.

 

Kevin

0 Karma

wangkevin1029
Communicator

wangkevin1029_0-1670422751090.png

 

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...