Splunk IT Service Intelligence

Filter Timechart Fields by Count

logankinman99
Path Finder

So I'm trying to write a query that allows for displaying a timechart after I've filtered fields by count using stats.
I've been able to filter fields by their counts with this...
host=server1 | stats count by errorName | where count > 250
...which does exactly what I want, returning only the errors that have occurred more than 250 times in the given time period.

What I cannot figure out, however, is how to take that and make a visualization out of it. If I change stats to timechart, it does not work. And neither does adding a timechart count after the where clause.
Any ideas would be very helpful!

Thanks,
Logan

0 Karma
1 Solution

adonio
Ultra Champion

| stats ... strips all fields that arent specifically defined either in the functions / attributes section or after the by clause ...
try something like this:

host = server1 | bin _time span=5m | stats count as error_count by errorName _time | where error_count > 250 | timechart span=30m avg(error_count) as avg_error_count by errorName

View solution in original post

adonio
Ultra Champion

| stats ... strips all fields that arent specifically defined either in the functions / attributes section or after the by clause ...
try something like this:

host = server1 | bin _time span=5m | stats count as error_count by errorName _time | where error_count > 250 | timechart span=30m avg(error_count) as avg_error_count by errorName

logankinman99
Path Finder

Hey, this worked pretty well! Thanks!

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...