Hi
I need to do a timechart from a single panel result
In this single panel, I stats events like this
| stats count as PbPerf by s
| search PbPerf>10
| stats dc(s)
The results of this search is 14 events
Now I need to timechart these 14 events
So I am doing this
| bin _time span=1d
| stats count as PbPerf by s _time
| search PbPerf>10
| timechart count span=1h
The first problem I have is that I want to retrieve the 14 events before doing the timechart is that I have to use a span=1d
But of course all the 14 events are grouped with the same _time even if I use a span=1h in the timechart
So how to display a timechart that display a _time value for my 14 events?
Thanks
Hi @jip31,
as I said, if using the BY clause probably you should better analyze your data to understand if the results you're waiting are correct.
Ciao.
Giuseppe
Hi @jip31,
at first, why don't you directly use timechart in you search?
| timechart span=1d count as PbPerf by s
| where PbPerf>10
but anyway, you cannot use before span=1d and then span=1h, because you have the same hour in each date for each day.
Ciao.
Giuseppe
Hi
Your idea is not bad but :
1) the where condition works only if I delete "by s"
2) if I timechart by s, I have only ten results for s
Hi @jip31,
this isn't a problem od the search but of your data, maybe you should use a different threshold.
When you say 14 results are you speking of two weeks or what else?
Ciao.
Giuseppe
it's 14 events
Hi @jip31,
as I said, if using the BY clause probably you should better analyze your data to understand if the results you're waiting are correct.
Ciao.
Giuseppe
Hi @jip31,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated 😉