Dashboards & Visualizations

timechart not working

sarit_s
Communicator

Hello
I have this query :

index="report" Computer_Name="*"  |chart dc(Category__Names_of_Patches) as totalNumberOfPatches by Computer_Name
| eval exposure_level = case(
    totalNumberOfPatches >= 3 AND totalNumberOfPatches <= 6, "Low Exposure",
    totalNumberOfPatches >= 7 AND totalNumberOfPatches <= 10, "Medium Exposure", 
    totalNumberOfPatches >= 11, "High Exposure", 
    totalNumberOfPatches == 2, "Compliant",
    totalNumberOfPatches == 1, "<not reported>",
    1=1,"other"
  )

| stats count(Computer_Name) as totalNumberOfPatches by exposure_level

| eval category=exposure_level

Looks like I've lost the _time field on the way so when im trying to run timechart im getting no results

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Correct, after the stats command you will only have totalNumberOfPatches and exposure_level. If you need _time after this point it should be added to the by clause, however, you may wish to bin it first, or replace the stats command with timechart

0 Karma

sarit_s
Communicator

Well, ive changed it to this :

| eval category=exposure_level
| timechart span=1d count(Computer_Name) as totalNumberOfPatches by category

but still no results

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Sorry, I missed the chart command on your first line. This is the command which is removing the timestamps.

0 Karma

sarit_s
Communicator

so what sould i do ? replacing it with timechart returns also no results

0 Karma

sarit_s
Communicator

solved it by changing to stats. thanks

0 Karma
Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...