Hi,
I'm not able to create a timechart graph for the below search, it is coming up with no result.
My current search is as below:
"My search
| stats count by xxx
| xxx = xxx * count
| stats sum(xxx) as "yyy"
"
This search gives the the correct total but only relating to the time range picker, how would I manipulate the query to get a time series graph by the sum of each day?
Since I don't know your data I tried to convert your search to timechart. I think xxx field is not a numeric field, so eval calculation is returning null value. I don't know your use case but below sample should work.
| timechart span=1d count by xxx
| eval xxx = 5 * count
| timechart span=1d sum(xxx) as yyy
Since I don't know your data I tried to convert your search to timechart. I think xxx field is not a numeric field, so eval calculation is returning null value. I don't know your use case but below sample should work.
| timechart span=1d count by xxx
| eval xxx = 5 * count
| timechart span=1d sum(xxx) as yyy
Hi @jamesboustead,
Since your search has no _time field on group by. "timechart" command use _time field for group by.
Please try below as a sample;
| timechart span=1d count by xxx
| eval xxx = xxx * count
| timechart span=1d sum(xxx) as yyy
If this reply helps you an upvote is appreciated.
This is now giving me two columns:
- one for "_time" which is split up daily which is good.
- one for 'yyy' but unfortunately this has no values underneath the column.
Please can you advise on how to get the value underneath 'yyy' corresponding to each day in the '_time' column?
Thank you
We can use timechart command.
index=_internal
| timechart span=1d count