This should do the task for you
source=ABC field1="xyz" | timechart span=1s count as req_per_second | timechart span=1hr max(req_per_second) as max | appendpipe [| gentimes start=-1 | addinfo | eval temp=info_min_time." ".info_max_time | table temp| makemv temp | mvexpand temp | rename temp as _time ] | timechart span=1h max(max) as max | makecontinuous | fillnull value=0
This should do the task for you
source=ABC field1="xyz" | timechart span=1s count as req_per_second | timechart span=1hr max(req_per_second) as max | appendpipe [| gentimes start=-1 | addinfo | eval temp=info_min_time." ".info_max_time | table temp| makemv temp | mvexpand temp | rename temp as _time ] | timechart span=1h max(max) as max | makecontinuous | fillnull value=0
EXCELLENT!!! I got results as expected. Thanks a ton....
Also. Can you help, If I need for one hour timechart with complete 60 mins info to display?
Thanks for the answer, I am not sure where is the wrong... I am receiving time from 1970. 🙂 is there any change we can do to display only 24 hr data. Thanks again.
What time range did you select while running the query? I guess you're running for All Time causing the info_min_time to go back to 1970. I suppose you should select some finite time range like Yesterday, last 7 days etc.
So if I'm understanding you correctly - you have data between 8am-6pm, but want to show a timechart from 00-24hr, where data that doesn't exist gets a null value as a "placeholder value".
try: | timechart span=1h count | appendpipe [|stats count |addinfo | eval temp=info_min_time."##".info_max_time | makemv temp delim="##" | mvexpand temp | eval count=0 | eval _time=temp | table _time count] | timechart span=1h sum(count) as count | fillnull
This will give those hours that have no data a 0 value.
Hi. Thanks for the answer but it didn't show 24 hrs. Actually I am calculating transaction per second in an hour. And showing in a timechart with only peak transactions in that hour for entire 24 hours.
Here I tried...
Source=ABC field1="xyz" | timechart span=1s count as req_per_second | timechart span=1hr max(req_per_second) as max | fillnull value=0 | table _time max