Splunk Search

How can I convert a naive timechart command to an efficient one?

ddrillic
Ultra Champion

The following works fine for me -

sourcetype=<sourcetype> index=<index> | timechart span=1d count 

How can I convert it to an efficient eventstats or tstats command?

0 Karma
1 Solution

somesoni2
Revered Legend

The tstats version will be like this

| tstats count WHERE index=<index> sourcetype=<sourcetype> by _time span=1d 

If you don't the visualization right, just add this as well to above search

above search | timechart span=1d sum(count) as count

View solution in original post

0 Karma

somesoni2
Revered Legend

The tstats version will be like this

| tstats count WHERE index=<index> sourcetype=<sourcetype> by _time span=1d 

If you don't the visualization right, just add this as well to above search

above search | timechart span=1d sum(count) as count
0 Karma

ddrillic
Ultra Champion

Gorgeous @somesoni2. You put a new picture! - I'm afraid to put mine - too scary ; -)

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...