Splunk Search

How to plot a timechart from a stats search output with span=1m?

MayankSplunk
Path Finder

After doing transaction, removing unique row and finally applying

| stats list(score) as score, list(Id) as Id by Type

gave me following result, can someone tell me a way to plot this as timechart span=1m avg(Score) by Type this command doesn't plot any data

Type          Score
A               123
                786
                 45

B                34
                 95
Tags (3)
0 Karma

somesoni2
Revered Legend

Try this
If you want avg of all values of score for a Type, including duplicates (two entries with same score and Type)

your base search ..before your stats | timechart span=1m avg(score) by Type

OR
If you want avg of only unique values of score for a Type, excludingduplicates

your base search ..before your stats | bucket span=1m _time | stats count by score, type, _time | timechart span=1m avg(score) by Type

MayankSplunk
Path Finder

Hi MuS,

Sorry that din't work.

0 Karma

MuS
Legend

You must make sure to have a _time field available after the stats or the timechart will fail, do as I said or do as @somesoni2 said 😉

0 Karma

MuS
Legend

Hi MayankSplunk,

after the stats you don't have _time available for timechart, so do something like this:

| stats list(score) as score, list(Id) as Id by Type, _time | timechart ....

cheers, MuS

Get Updates on the Splunk Community!

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and ...

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and Splunk ES Protecting a ...

It's Customer Success Time at .conf25

Hello Splunkers,   Ready for .conf25? The customer success and experience team is and can’t wait to see you ...

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...