How do you use the stats command on a timechart output?

[asharm65]

Hi,

i wanted to calculate a count for every 1 sec period and then find the max of the count per day.

i have calculated the count using timechart function.Using query below:

1)..base_query|timechart span=1s count(field_1) as c by field_2

The output of the above query gives a count every 1 second.

Now to calculate the max of count per day. i tried using stats:

2)..base_query|timechart span=1s count(field_1) as c by field_2|stats max(c) by Date

But, the 2nd query does not give desired output.

Thanks in Advance!!!

[FrankVl]

Where do you get that by Date from? That Date field doesn't exist (at least not given the exact query you are showing here).

If you want to get the max per-second-count by day, try it like this:

...base_query
| timechart span=1s count(field_1) as c by field_2
| bin _time span=1d
| stats max(c) by _time

[asharm65]

This does not give any output

[FrankVl]

Can you share the actual search you are running which doesn't give output and / or a screenshot of the situation?