Splunk Search

TimeChart Syntax

Substance82
Path Finder

Stuck again and not sure what I'm missing... I have the first two steps, but cannot figure out the syntax to use Timechart to count all events as a specific label. Any help is greatly appreciated. 

The Task:  Use timechart to calculate the sum of price as "DailySales" and all count all events as "UnitsSold".

What I have so far: 

index=web sourcetype=access_combined status=200 productId=*
|timechart sum(price) as DailySales
Labels (1)
Tags (2)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

This is a little confusing.  You are almost there:

index=web sourcetype=access_combined status=200 productId=*
|timechart sum(price) as DailySales count as UnitsSold

Is there something else we need to know?

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

This is a little confusing.  You are almost there:

index=web sourcetype=access_combined status=200 productId=*
|timechart sum(price) as DailySales count as UnitsSold

Is there something else we need to know?

Substance82
Path Finder

Lol almost there, but a million miles away. I attempted something similar, but didn't fair well. Thanks a million.  Still working through a few new modules, but learning more each day. 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Manage Edge Processor pipelines end to end with APIs

This guide uses the Data Management APIs to create an Edge Processor, onboard one instance, deploy a pipeline ...

Splunk Brings Proof of Control to Digital Asset Transfers

Digital assets now sit inside the core of financial services. HSBC launched its Tokenized Deposit Service in ...

Manage Ingest Processor pipelines end to end with APIs

This guide uses the Data Management APIs to create an Ingest Processor pipeline, deploy it to the ...