timechart not working

[sarit_s]

Hello
I have this query :

index="report" Computer_Name="*"  |chart dc(Category__Names_of_Patches) as totalNumberOfPatches by Computer_Name
| eval exposure_level = case(
    totalNumberOfPatches >= 3 AND totalNumberOfPatches <= 6, "Low Exposure",
    totalNumberOfPatches >= 7 AND totalNumberOfPatches <= 10, "Medium Exposure", 
    totalNumberOfPatches >= 11, "High Exposure", 
    totalNumberOfPatches == 2, "Compliant",
    totalNumberOfPatches == 1, "<not reported>",
    1=1,"other"
  )

| stats count(Computer_Name) as totalNumberOfPatches by exposure_level

| eval category=exposure_level

Looks like I've lost the _time field on the way so when im trying to run timechart im getting no results

[ITWhisperer]

Correct, after the stats command you will only have totalNumberOfPatches and exposure_level. If you need _time after this point it should be added to the by clause, however, you may wish to bin it first, or replace the stats command with timechart

[sarit_s]

Well, ive changed it to this :

| eval category=exposure_level
| timechart span=1d count(Computer_Name) as totalNumberOfPatches by category

but still no results

[ITWhisperer]

Sorry, I missed the chart command on your first line. This is the command which is removing the timestamps.

[sarit_s]

so what sould i do ? replacing it with timechart returns also no results

[sarit_s]

solved it by changing to stats. thanks