Monitoring Splunk

timechart errror

splunkpoornima
Communicator

hi all,

i run this below query but it shows me error as

fiels"_time" Field '_time' should have numerical values.

source="C:\Users\20875\Desktop\taskmanager_log.txt" | transaction TaskBP startswith=START endswith=Succeeded | table TaskBP duration | join TaskBP [ | search source="C:\Users\20875\Desktop\task.txt"| transaction TaskBP startswith=START endswith=Succeeded|stats avg(duration) as Avgduration by TaskBP] | eval Diff=duration-Avgduration | table TaskBP Diff | where (Diff>-100 AND Diff<100) | timechart count(Diff) by TaskBP

kindly help me to get rid of this error

thanks in advance

poornima

Tags (1)
0 Karma

Drainy
Champion

Well, at a first guess without any testing you've removed the _time field by using the reporting command table to only pass those two fields.
Each time you pipe results over, reporting commands will only pass the fields you tell them to. Try adding _time to your commands and please please please read the tutorials

Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...