Splunk Search

Timechart not coming up instead a table is coming up for it

mayank101
New Member

Timechart not coming up instead a table is coming up for it.Can anyone tell me what's wrong with the query.I want a timechart to be displayed instead of the table .

    <label>Filter Entity (once results loaded now define your enity to filter)</label>
    <default>*</default>
    <initialValue>*</initialValue>
  </input>
  <table>
    <search>
      <query>index="****" 
        publisher="***" entity="$select_entityprefix$*boot*" 
         |rex field=entity "_(?!.*_)(?<host>.*)"

        |search resource=$select_resource$
        |search entity="*$select_entity2$*"
        |table _time  entity resource  description
        |timechart count by entity</query>
      <earliest>$time_tok.earliest$</earliest>
      <latest>$time_tok.latest$</latest>
    </search>
    <option name="count">15</option>
    <option name="dataOverlayMode">none</option>
    <option name="drilldown">cell</option>
    <option name="rowNumbers">false</option>
    <option name="wrap">true</option>
  </table>
Tags (1)
0 Karma
1 Solution

vnravikumar
Champion

hi

Use chart instead of table tag

<chart id="test">
         <title>Test Image background</title>
         <search>
           <query>index=_internal | timechart  count</query>
           <earliest>-24h@h</earliest>
           <latest>now</latest>
         </search>
         <option name="charting.chart">line</option>
         <option name="charting.drilldown">none</option>
       </chart>

View solution in original post

0 Karma

vnravikumar
Champion

hi

Use chart instead of table tag

<chart id="test">
         <title>Test Image background</title>
         <search>
           <query>index=_internal | timechart  count</query>
           <earliest>-24h@h</earliest>
           <latest>now</latest>
         </search>
         <option name="charting.chart">line</option>
         <option name="charting.drilldown">none</option>
       </chart>
0 Karma

mayank101
New Member

Thank you so much for your help vnravikumar.It worked.

0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...