Splunk Search

Stats values Into timechart -- I can't get timechart to work

IRHM73
Motivator

Hi, I wonder whether someone could help me please.

I've put together this query:

| multisearch
[ search `frontenda_wmf(Payments)` detail.dueDate="2018-01-31"]
[ search `frontendb_wmf(RequestReceived)` detail.queryString="*AUTHORISED*HM00*"]
| stats values(detail.dueDate) as due values(detail.queryString) as query values(auditSource) as auditSource values(auditType) as auditType by tags.IP
| where (auditSource="frontenda" AND auditSource="frontendb" AND auditType="Payments" AND auditType="RequestReceived")
| timechart span=1d count(due)

The problem I'm having is that I can't get the timechart to work. I've also tried just using chart and that doesn't work either.

Could someone possibly look at this please and let me know where I've gone wrong?

Many thanks and kind regards

Chris

0 Karma
1 Solution

niketn
Legend

@IRHM73, your stats command is removing _time field which is required for timechart so you need to change to following:

  | multisearch
 [ search `frontenda_wmf(Payments)` detail.dueDate="2018-01-31"]
 [ search `frontendb_wmf(RequestReceived)` detail.queryString="*AUTHORISED*HM00*"]
 | bin _time span=1d 
 | stats values(detail.dueDate) as due values(detail.queryString) as query values(auditSource) as auditSource values(auditType) as auditType by tags.IP _time
 | search auditSource="frontenda" AND auditSource="frontendb" AND auditType="Payments" AND auditType="RequestReceived"
 | timechart span=1d count(due)

Please try and confirm.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@IRHM73, your stats command is removing _time field which is required for timechart so you need to change to following:

  | multisearch
 [ search `frontenda_wmf(Payments)` detail.dueDate="2018-01-31"]
 [ search `frontendb_wmf(RequestReceived)` detail.queryString="*AUTHORISED*HM00*"]
 | bin _time span=1d 
 | stats values(detail.dueDate) as due values(detail.queryString) as query values(auditSource) as auditSource values(auditType) as auditType by tags.IP _time
 | search auditSource="frontenda" AND auditSource="frontendb" AND auditType="Payments" AND auditType="RequestReceived"
 | timechart span=1d count(due)

Please try and confirm.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

IRHM73
Motivator

Hi @niketnilay, this works perfectly thank you.

If you want to add this as an answer I can accept it for you.

Regards

Chris

0 Karma

niketn
Legend

@IRHM73, Glad it worked... I have converted to answer. Please accept to mark as answered!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

gcusello
Esteemed Legend

Hi IRHM73.
at first in your stats command you haven't _time as values so you haven't it in the following timechart.
Anyway, what's the output of your search without the timechart command?
To execute the timechart count(due) command you need at least of two fields -time and due, are there?
Bye.
Giuseppe

0 Karma

IRHM73
Motivator

Hi @cusello, thank you for taking the time to reply to my post.

You'll see that both @cmerriman and @niketnilay were along similar lines.

Kind Regards

Chris

0 Karma

cmerriman
Super Champion

for timechart to work, you need _time in your results. try working _time into your multisearch/stats command before timechart. you can add in |bucket span=1d _time |stats ..... by tags.IP _time and then it is already bucketed by 1 day. If detail.dueDate is what the days need to be bucketed by, you'll need to create an eval like |eval _time=strptime(detail.dueDate,"%Y-%m-%d")

IRHM73
Motivator

Hi @cmerriman. Thank you for taking the time to come back to me with this and for the alternative solution to @niketnilay.

Kind Regards

Chris

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...