Splunk IT Service Intelligence

Filter Timechart Fields by Count

logankinman99
Path Finder

So I'm trying to write a query that allows for displaying a timechart after I've filtered fields by count using stats.
I've been able to filter fields by their counts with this...
host=server1 | stats count by errorName | where count > 250
...which does exactly what I want, returning only the errors that have occurred more than 250 times in the given time period.

What I cannot figure out, however, is how to take that and make a visualization out of it. If I change stats to timechart, it does not work. And neither does adding a timechart count after the where clause.
Any ideas would be very helpful!

Thanks,
Logan

0 Karma
1 Solution

adonio
Ultra Champion

| stats ... strips all fields that arent specifically defined either in the functions / attributes section or after the by clause ...
try something like this:

host = server1 | bin _time span=5m | stats count as error_count by errorName _time | where error_count > 250 | timechart span=30m avg(error_count) as avg_error_count by errorName

View solution in original post

adonio
Ultra Champion

| stats ... strips all fields that arent specifically defined either in the functions / attributes section or after the by clause ...
try something like this:

host = server1 | bin _time span=5m | stats count as error_count by errorName _time | where error_count > 250 | timechart span=30m avg(error_count) as avg_error_count by errorName

logankinman99
Path Finder

Hey, this worked pretty well! Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...