How to use timechart with stats and eval command

[sunnyparmar]

Hi,

My query is below -

index=abc sourcetype=xyz Unable to connect to the remote server | Stats count(eval("Unable to connect to the remote server")) as "Error" by host

In this query how can I use (timechart span=1h) function? Any suggestions would be appreciated..

Thanks

[woodcock · Accepted solution]

Your eval is wrong and redundant; try this:

index=abc sourcetype=xyz Unable to connect to the remote server | timechart span=1h count AS "Error" by host

[sunnyparmar]

thanks... that's cool..