Splunk Search

Timechart, how to display value of field without function?

Chaser
Explorer
index="redis" sourcetype="csv" total_commands_processed="*" | timechart span=5m total_commands_processed

In the search command above, I want to display value of field "total_commands_processed", anyone can help

Labels (2)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index="redis" sourcetype="csv" total_commands_processed="*" | timechart span=5m max(total_commands_processed) as total_commands_processed

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index="redis" sourcetype="csv" total_commands_processed="*" | timechart span=5m max(total_commands_processed) as total_commands_processed

Chaser
Explorer

Thank you so much, it helped me 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Cloud Platform | Customer Change Announcement: Email Notification Will Be Available ...

The Notification Team is migrating our email service provider since currently there’s no support ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...