Splunk Search

How to display min and max in a timechart?

jip31
Motivator

hello

 

I use this timechart

 

index=tutu sourcetype=titi 
| timechart span=15min dc(s) as "Uniq"

 

 Now i would like to display 2 more lines with min and max for "s" field

is it possible

Labels (2)
Tags (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

Verify that the field you're trying to calculate max and min on are numeric fields.

With simple stats max() and min() on text field would give you results (although it would be calculated based on lexicographic order) but timechart will return empty result of such aggregation.

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this:

| timechart dc(value) as unique min(value) as min_s max(value) as max_s span=15m

 

0 Karma

jip31
Motivator

it's exactly what I done and I have no results...

i have just results with 

 

| timechart dc(value) as unique​

 

 
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Verify that the field you're trying to calculate max and min on are numeric fields.

With simple stats max() and min() on text field would give you results (although it would be calculated based on lexicographic order) but timechart will return empty result of such aggregation.

0 Karma

jip31
Motivator

your are right

"s" field is not numeric

when I am doing dc(s) , i count the number of "s" fields so it works but for min and max because its not numeric it doesnt works of course

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Sounds like there is something different about your data or setup, because this is the way to do what you asked. Can you share more details and a screenshot of your results?

0 Karma

jip31
Motivator

if i just run

 | timechart span=15min dc(s) as "Nb"

I have results

jip31_0-1646219026219.png

but if I run

 | timechart span=15min dc(s) as "Nb" min(s) as min, max(s) as max

I have any results

jip31_1-1646219311699.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do you get anything if you just do min?

 | timechart span=15min min(s) as min
0 Karma

jip31
Motivator

no

0 Karma

tshah-splunk
Splunk Employee
Splunk Employee

Hey @jip31,

Along with the dc function, you can also use the min() and max() functions to fetch the minimum and maximum value of the field respectively. Your query should look something like below

index=tutu sourcetype=titi 
| timechart span=15min dc(s) as "Uniq" min(s) as s_min max(s) as s_max
---
If you find the answer helpful, an upvote/karma is appreciated
0 Karma

jip31
Motivator

hi

it's exactly what I done and I have no results...

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...