timechart errror

[splunkpoornima]

hi all,

i run this below query but it shows me error as

fiels"_time" Field '_time' should have numerical values.

source="C:\Users\20875\Desktop\taskmanager_log.txt" | transaction TaskBP startswith=START endswith=Succeeded | table TaskBP duration | join TaskBP [ | search source="C:\Users\20875\Desktop\task.txt"| transaction TaskBP startswith=START endswith=Succeeded|stats avg(duration) as Avgduration by TaskBP] | eval Diff=duration-Avgduration | table TaskBP Diff | where (Diff>-100 AND Diff<100) | timechart count(Diff) by TaskBP

kindly help me to get rid of this error

thanks in advance

poornima

[Drainy]

Well, at a first guess without any testing you've removed the _time field by using the reporting command table to only pass those two fields.
Each time you pipe results over, reporting commands will only pass the fields you tell them to. Try adding _time to your commands and please please please read the tutorials