Splunk Search

TimeChart Syntax

Substance82
Path Finder

Stuck again and not sure what I'm missing... I have the first two steps, but cannot figure out the syntax to use Timechart to count all events as a specific label. Any help is greatly appreciated. 

The Task:  Use timechart to calculate the sum of price as "DailySales" and all count all events as "UnitsSold".

What I have so far: 

index=web sourcetype=access_combined status=200 productId=*
|timechart sum(price) as DailySales
Labels (1)
Tags (2)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

This is a little confusing.  You are almost there:

index=web sourcetype=access_combined status=200 productId=*
|timechart sum(price) as DailySales count as UnitsSold

Is there something else we need to know?

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

This is a little confusing.  You are almost there:

index=web sourcetype=access_combined status=200 productId=*
|timechart sum(price) as DailySales count as UnitsSold

Is there something else we need to know?

Substance82
Path Finder

Lol almost there, but a million miles away. I attempted something similar, but didn't fair well. Thanks a million.  Still working through a few new modules, but learning more each day. 

0 Karma
Get Updates on the Splunk Community!

Alerting Best Practices: How to Create Good Detectors

At their best, detectors and the alerts they trigger notify teams when applications aren’t performing as ...

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...