Splunk Search

TimeChart Syntax

Substance82
Path Finder

Stuck again and not sure what I'm missing... I have the first two steps, but cannot figure out the syntax to use Timechart to count all events as a specific label. Any help is greatly appreciated. 

The Task:  Use timechart to calculate the sum of price as "DailySales" and all count all events as "UnitsSold".

What I have so far: 

index=web sourcetype=access_combined status=200 productId=*
|timechart sum(price) as DailySales
Labels (1)
Tags (2)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

This is a little confusing.  You are almost there:

index=web sourcetype=access_combined status=200 productId=*
|timechart sum(price) as DailySales count as UnitsSold

Is there something else we need to know?

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

This is a little confusing.  You are almost there:

index=web sourcetype=access_combined status=200 productId=*
|timechart sum(price) as DailySales count as UnitsSold

Is there something else we need to know?

Substance82
Path Finder

Lol almost there, but a million miles away. I attempted something similar, but didn't fair well. Thanks a million.  Still working through a few new modules, but learning more each day. 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Event Series: Telemetry Pipeline Management

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...