Monitoring Splunk

timechart errror

splunkpoornima
Communicator

hi all,

i run this below query but it shows me error as

fiels"_time" Field '_time' should have numerical values.

source="C:\Users\20875\Desktop\taskmanager_log.txt" | transaction TaskBP startswith=START endswith=Succeeded | table TaskBP duration | join TaskBP [ | search source="C:\Users\20875\Desktop\task.txt"| transaction TaskBP startswith=START endswith=Succeeded|stats avg(duration) as Avgduration by TaskBP] | eval Diff=duration-Avgduration | table TaskBP Diff | where (Diff>-100 AND Diff<100) | timechart count(Diff) by TaskBP

kindly help me to get rid of this error

thanks in advance

poornima

Tags (1)
0 Karma

Drainy
Champion

Well, at a first guess without any testing you've removed the _time field by using the reporting command table to only pass those two fields.
Each time you pipe results over, reporting commands will only pass the fields you tell them to. Try adding _time to your commands and please please please read the tutorials

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...