Splunk Search

How to use timechart span

sudeep5689
Explorer

I have a query in splunk
index = * STATUS_CODE earliest=-2mon@mon latest=-1mon@mon | fields STATUS_CODE | rex field=_raw "STATUS_CODE:(?.{0,1}\d)"
| eval success=if(status_code in(0,1),1,0) | timechart count as total sum(success) as success
| eval success_rate=round((success/total)*100,3)
| eval success_rate=success_rate + "%" | table _time success_rate | append [search index = * STATUS_CODE earliest=-1mon@mon latest=@mon | fields STATUS_CODE | rex field=_raw "STATUS_CODE:(?.{0,1}\d)"
| eval success=if(status_code in(0,1),1,0) | timechart count as total sum(success) as success
| eval success_rate=round((success/total)*100,3)
| eval success_rate=success_rate + "%" | table _time success_rate]

I want to show the single value visualization displaying the increase/decrease in success_rate, but its not displaying correctly. I mean i need to add a timechart command again but thats not working. Can anyone help

Labels (2)
0 Karma

493669
Super Champion
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...