How to display min and max in a timechart?

[jip31]

hello

I use this timechart

index=tutu sourcetype=titi 
| timechart span=15min dc(s) as "Uniq"

 Now i would like to display 2 more lines with min and max for "s" field

is it possible

[ITWhisperer]

Try this:

| timechart dc(value) as unique min(value) as min_s max(value) as max_s span=15m

[jip31]

it's exactly what I done and I have no results...

i have just results with 

| timechart dc(value) as unique​

[PickleRick · Accepted solution]

Verify that the field you're trying to calculate max and min on are numeric fields.

With simple stats max() and min() on text field would give you results (although it would be calculated based on lexicographic order) but timechart will return empty result of such aggregation.

[jip31]

your are right

"s" field is not numeric

when I am doing dc(s) , i count the number of "s" fields so it works but for min and max because its not numeric it doesnt works of course

[ITWhisperer]

Sounds like there is something different about your data or setup, because this is the way to do what you asked. Can you share more details and a screenshot of your results?

[jip31]

if i just run

 | timechart span=15min dc(s) as "Nb"

I have results

but if I run

 | timechart span=15min dc(s) as "Nb" min(s) as min, max(s) as max

I have any results

[ITWhisperer]

Do you get anything if you just do min?

 | timechart span=15min min(s) as min

[jip31]

no

[tshah-splunk]

Hey @jip31,

Along with the dc function, you can also use the min() and max() functions to fetch the minimum and maximum value of the field respectively. Your query should look something like below

index=tutu sourcetype=titi 
| timechart span=15min dc(s) as "Uniq" min(s) as s_min max(s) as s_max

[jip31]

hi

it's exactly what I done and I have no results...