Splunk Search

Put the time a the top of a timechart

Alaza
Explorer

alt text

Hello,
How can I have a table like the picture with the time a the top, the type on the right side and a count by date on the row ?
With timechart It doesn't work :

index="Ico_number" Type_Group
| timechart count by Type_Group

Tags (3)
0 Karma
1 Solution

tiagofbmm
Influencer

Try this and adjust to your case

index=_internal 
| bucket _time span=1h 
| chart count by source, _time 
| addtotals

alt text

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi Alaza,
only few additional information to better understand your needs:

  • What's "Type_Group" a field or a string to search?
  • why do you say that timechart isn't running? don't you receive events or do they aren't correctly organized?
  • did you used span?

From your picture I see that you haven't weekends, you can filter results putting date_wday!=sunday OR date_waday!=saturday in your main search.
In other words, try something like this

index="Ico_number" date_wday!=sunday OR date_waday!=saturday
| timechart span=1d count by Type_Group

Bye.
Giuseppe

0 Karma

Alaza
Explorer

Type_Group is a field and I can't display the value like the picture, weekend or not.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Ok this probably is the reason because your search doesn't run, if you put a field in a search you have to assign a value, something like this

index="Ico_number" Type_Group=*

otherwise Splunk interpretes "Type_Group" as a string to search.
So try something like this
index="Ico_number" Type_Group=*
| timechart span=1d count by Type_Group
Bye.
Giuseppe

0 Karma

Alaza
Explorer

Thanks for your help, it works now.

0 Karma

tiagofbmm
Influencer

Try this and adjust to your case

index=_internal 
| bucket _time span=1h 
| chart count by source, _time 
| addtotals

alt text

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...