I have an SPL which gives a result. I want to get a trend of the result.
So I tried using timechart command, but it is not working.
Query
| tstats `summariesonly` earliest(_time) as _time from datamodel=Incident_Management.Notable_Events_Meta by source,Notable_Events_Meta.rule_id | `drop_dm_object_name("Notable_Events_Meta")` | `get_correlations` | join rule_id [| from inputlookup:incident_review_lookup | eval _time=time | stats earliest(_time) as review_time by rule_id] | eval ttt=review_time-_time | stats avg(ttt) as avg_ttt | sort - avg_ttt | `uptime2string(avg_ttt, avg_ttt)` | rename *_ttt* as *(Time_To_Triage)* | fields - *_dec |table avg(Time_To_Triage) |rename avg(Time_To_Triage) as "Mean/Average Time To Respond"
If you want to use timechart, your _time cannot be a single value such as earliest(_time) will give. (Besides, min(_time) is more efficient than earliest(_time).) With tstats, you need to chop off _time the same way you want timechart to chop off time into intervals. Say, you want to have 5-minute intervals,
| tstats `summariesonly` from datamodel=Incident_Management.Notable_Events_Meta by source,Notable_Events_Meta.rule_id _time span=5m
| `drop_dm_object_name("Notable_Events_Meta")`
| `get_correlations`
| join rule_id
[| from inputlookup:incident_review_lookup
| eval _time=time
| stats earliest(_time) as review_time by rule_id]
| eval ttt=review_time-_time
| timechart span=5m avg(ttt) as avg_ttt
| sort - avg_ttt
| `uptime2string(avg_ttt, avg_ttt)`
| rename *_ttt* as *(Time_To_Triage)*
| fields - *_dec
| table avg(Time_To_Triage)
| rename avg(Time_To_Triage) as "Mean/Average Time To Respond"
timechart requires the _time field being in the dataset sent to it.
That field doesn't exist once you do :
| stats avg(ttt) as avg_ttt
You also cant chart a string value. Your `uptime2String()` macro means you no longer have a value that can be compared in a chart.