Splunk Search

Put the time a the top of a timechart

Alaza
Explorer

alt text

Hello,
How can I have a table like the picture with the time a the top, the type on the right side and a count by date on the row ?
With timechart It doesn't work :

index="Ico_number" Type_Group
| timechart count by Type_Group

Tags (3)
0 Karma
1 Solution

tiagofbmm
Influencer

Try this and adjust to your case

index=_internal 
| bucket _time span=1h 
| chart count by source, _time 
| addtotals

alt text

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi Alaza,
only few additional information to better understand your needs:

  • What's "Type_Group" a field or a string to search?
  • why do you say that timechart isn't running? don't you receive events or do they aren't correctly organized?
  • did you used span?

From your picture I see that you haven't weekends, you can filter results putting date_wday!=sunday OR date_waday!=saturday in your main search.
In other words, try something like this

index="Ico_number" date_wday!=sunday OR date_waday!=saturday
| timechart span=1d count by Type_Group

Bye.
Giuseppe

0 Karma

Alaza
Explorer

Type_Group is a field and I can't display the value like the picture, weekend or not.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Ok this probably is the reason because your search doesn't run, if you put a field in a search you have to assign a value, something like this

index="Ico_number" Type_Group=*

otherwise Splunk interpretes "Type_Group" as a string to search.
So try something like this
index="Ico_number" Type_Group=*
| timechart span=1d count by Type_Group
Bye.
Giuseppe

0 Karma

Alaza
Explorer

Thanks for your help, it works now.

0 Karma

tiagofbmm
Influencer

Try this and adjust to your case

index=_internal 
| bucket _time span=1h 
| chart count by source, _time 
| addtotals

alt text

View solution in original post

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!