HI ,
I am trying to get the number of hits of users for very 3 minutes .
And am able to generate the chart with below command.
index=jira source="/opt/access_log.2020-04-23" host="xyz | bucket _time span=3m | chart count over user by _time
This generated the table but when viewing the events the events are showing only for a particular time and not time span.
eg:Its showing events for 12:00 but i need 12:00 to 12:03?
Can anyone tell what am i doing wrong?
The bucket
command "rounds off" the time to the start of the interval. You'll see events for 12:00, 12:03, 12:06, etc. rather than 12:00, 12:01, 12:02 and so on.
You can try timechart
, but you'll likely get the same results.
index=jira source="/opt/access_log.2020-04-23" host="xyz" | timechart span=3m count by user
The bucket
command "rounds off" the time to the start of the interval. You'll see events for 12:00, 12:03, 12:06, etc. rather than 12:00, 12:01, 12:02 and so on.
You can try timechart
, but you'll likely get the same results.
index=jira source="/opt/access_log.2020-04-23" host="xyz" | timechart span=3m count by user
Thanks much for the response.
index=jira source="/opt/access_log.2020-04-23" host="xyz | bucket _time span=3m | chart count over user by _time
But getting error.
Error in 'timechart' command: You must specify data field(s) to chart.
The error doesn't match the query. There is no timechart
command in the query.
oh sorry missed that.
This was the query.
index=jira source="/opt/access_log.2020-04-23" host="xyz | timechart span=3m | chart count over user by _time
Please look closely at my answer. bucket
and chart
are replaced by timechart
.