Splunk Search

Timechart trend over the same interval as the search range

epacke
Path Finder

Hi!

I have a scenario where we have used "| stats count" and gotten the total number for the range that we picked. This has been working fine, but now, we'd like to use timechart to get trends.

However, when using timechart, the number becomes the latest "bucket" instead of the total number.

Example:
Searching with a time range of 60 minutes would give me the value for the last minute.

Been fiddling around with some suggestions but haven't found a reliable solution. This last one:

| timechart [search index=_internal | head 1 | addinfo | eval timerange= info_max_time-info_min_time | eval span=if(round(timerange/3600) == infinity, 1, round(timerange/3600))."h"  | return span] count | appendpipe [stats count | where count=0]

It generates errors like "Error in timechart command. The value for option span (infinityh) is invalid."

Any ideas of what I'm doing wrong?

/Patrik

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Timechart is going to give you a new row for each bucket. Why use timechart if you don't want seperate buckets? Why use head 1 to return the latest bucket? If you were sold on using timechart then you would have to force it to use a single bucket by adding span=60m which would give you identical results of using stats

These 2 queries will give identical results

| bin _time span=60m
| stats count by _time 



| timechart span=60m count
0 Karma

epacke
Path Finder

Timechart is used because I want the trend. Span=60m works but since I have a time picker this would not work for longer search ranges.

0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on