Splunk Search

Timechart of max(variable) - get actual time of peak, instead of bin time

sperl
New Member

When I do a timechart - I get the max of my variable in the chart.

However, if I hover over the value - the time associated is the bin time of the timechart and not the actual time of the event.

i.e. for a 24 hour search
timechart max(latency) span=30m

If I had an event measuring 1500 at 10:37:45 which was the max in that bin, it will chart 1500, but it will timestamp at 10;30, the beginning of the bin.

How do I get it to show the actual event _time ?

Tags (1)
0 Karma

somesoni2
Revered Legend

Give this a try

your base search 
| eventstats max(latency) as max 
| eval MaxTimestamp=if(latency=max,_time,null())
| timechart span=30m max(latency) as maxLatency values(MaxTimestamp) as MaxTimestamp values(max) as max
| appendpipe [| dedup MaxTimestamp max | eval _time=MaxTimestamp | eval maxLatency =max ]
| table _time maxLatency | sort _time
0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...