Splunk Search

How do I get the timechart results for a summary index query?

pavanae
Builder

I have a query which uses the summary index and some lookup tables with eval conditions and ends with...

| chart count by field_a,  field_b

...which is working fine and gives me the statistics. But, when I tried the same query by replacing the "chart count by" with "timechart count by", it gives me an error as follows and doesn't work:

error:- Error in 'timechart' command: The argument 'field_b' is invalid.

Could anyone explain why the query with timechart doesn't work but the query with chart did?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

@pavanae Is your problem resolved? If so, please accept one of the answers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

sir_lamneth
Explorer

The main thing is timechart doesn't let you do include multiple fields in its by clause. Commands like stats and chart do. You can also fake it by concatenating your two fields into one, and using that in timechart:

 | eval marker=field_a+field_b | timechart count by marker
0 Karma

briancronrath
Contributor

This is what I usually do, with the only change I concatenate using the period "." symbol to eliminate possible weirdness with it trying to add numeric values together. | eval marker=field_a.field_b | timechart count by marker

0 Karma

HiroshiSatoh
Champion

Since the X axis is _time and the Y axis is field_a, field_b is invalid.
How's this?

(your search)|bin span=XX _time| stats count by _time,field_a, field_b
0 Karma

pavanae
Builder

It doesn't give me an error now but I see no results. Looks like _time not working though I see _time on all the summary indexing events

0 Karma

HiroshiSatoh
Champion

What is the state of not functioning?
What is set in the _time of the search result?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...