Put the time a the top of a timechart

[Alaza]

Hello,
How can I have a table like the picture with the time a the top, the type on the right side and a count by date on the row ?
With timechart It doesn't work :

index="Ico_number" Type_Group
| timechart count by Type_Group

[gcusello]

Hi Alaza,
only few additional information to better understand your needs:

• What's "Type_Group" a field or a string to search?
• why do you say that timechart isn't running? don't you receive events or do they aren't correctly organized?
• did you used span?

From your picture I see that you haven't weekends, you can filter results putting date_wday!=sunday OR date_waday!=saturday in your main search.
In other words, try something like this

index="Ico_number" date_wday!=sunday OR date_waday!=saturday
| timechart span=1d count by Type_Group

Bye.
Giuseppe

[Alaza]

Type_Group is a field and I can't display the value like the picture, weekend or not.

[gcusello]

Ok this probably is the reason because your search doesn't run, if you put a field in a search you have to assign a value, something like this

index="Ico_number" Type_Group=*

otherwise Splunk interpretes "Type_Group" as a string to search.
So try something like this
index="Ico_number" Type_Group=*
| timechart span=1d count by Type_Group
Bye.
Giuseppe

[Alaza]

Thanks for your help, it works now.

[tiagofbmm · Accepted solution]

Try this and adjust to your case

index=_internal 
| bucket _time span=1h 
| chart count by source, _time 
| addtotals