Splunk Search

Create a time series graph after a stats command

jamesboustead
Explorer

Hi,

I'm not able to create a timechart graph for the below search, it is coming up with no result.

My current search is as below:

"My search 

| stats count by xxx

| xxx = xxx * count

| stats sum(xxx) as "yyy"

"

 

This search gives the the correct total but only relating to the time range picker, how would I manipulate the query to get a time series graph by the sum of each day?

Labels (3)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Since I don't know your data I tried to convert your search  to timechart. I think xxx field is not a numeric field, so eval calculation is returning null value. I don't know your use case but below sample should work.

| timechart span=1d count by xxx
| eval xxx = 5 * count
| timechart span=1d sum(xxx) as yyy
If this reply helps you an upvote is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Since I don't know your data I tried to convert your search  to timechart. I think xxx field is not a numeric field, so eval calculation is returning null value. I don't know your use case but below sample should work.

| timechart span=1d count by xxx
| eval xxx = 5 * count
| timechart span=1d sum(xxx) as yyy
If this reply helps you an upvote is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @jamesboustead,

Since your search has no _time field on group by. "timechart" command use _time field for group by.

Please try below as a sample;

| timechart span=1d count by xxx
| eval xxx = xxx * count
| timechart span=1d sum(xxx) as yyy

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote is appreciated.
0 Karma

jamesboustead
Explorer

This is now giving me two columns:

- one for "_time" which is split up daily which is good.

- one for 'yyy' but unfortunately this has no values underneath the column.

 

Please can you advise on how to get the value underneath 'yyy' corresponding to each day in the '_time' column?

 

Thank you

0 Karma

saravanan90
Contributor

We can use timechart command. 

index=_internal
| timechart span=1d count

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!