- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Marco_Develops
Path Finder
05-09-2022
01:14 PM
I'm trying to make a time chart where it uses the time value specified in my table. Rather than the default _time value.
Currently I'm trying something like this:
base search
|eval Failures = if(STATUS ="Failed",1,0)
| timechart sum(Failures) by TIME
DATE | TIME | SYSTEM | Failures |
03/01/2022 | 12:00 | Development | 10 |
03/01/2022 | 13:00 | Development | 2 |
04/01/2022 | 15:00 | Development | 3 |
05/01/2022 | 18:00 | Development | 8 |
Any suggestions help :-).
Thank you,
Marco
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
SplunkTrust
05-09-2022
03:10 PM
base search
| eval Failures = if(STATUS ="Failed",1,0)
| chart sum(Failures) by TIME
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
SplunkTrust
05-09-2022
03:10 PM
base search
| eval Failures = if(STATUS ="Failed",1,0)
| chart sum(Failures) by TIME
![](/skins/images/396DDBEEAC295EB5FEC41FF128E8AC0A/responsive_peak/images/icon_anonymous_message.png)