I have a query that accumulates the total count for host over a 6 period of month. Now when I am trying to draw time chart for it ,I am unable to do so.It shows no result .
| savedsearch "r1"
| top 10 event by host | sort-count | eventstats sum(count) as TotalNumber| eval PercentOfTotal = round(100 * count / TotalNumber,2). "%"
| stats list(entity) as "Entity" list(count) as "Count", sum(count) as "Total" by event
| sort-Total
| addinfo
| eval rank=1 | accum rank | sort +num(rank) | head (rank <=10) | fields rank, host,event, Entity, Count,Total | eval Entity=mvindex(Entity,0,9)
| eval Count=mvindex(Count,0,9) | eval Percent=mvindex(Percent,0,9)
|timechart span=1d useother=f count by host
Can you please help in drawing timechart
Timechart requires _time in order to function, but your "stats" commands don't pass _time through. Assuming your saved search includes _time, try this:
| savedsearch "r1"
| bin _time span=1d
| top 10 event by host, _time
| sort-count
| eventstats sum(count) as TotalNumber
| eval PercentOfTotal = round(100 * count / TotalNumber,2). "%"
| stats list(entity) as "Entity" list(count) as "Count", sum(count) as "Total" by event, _time
| sort-Total
| addinfo
| eval rank=1
| accum rank
| sort +num(rank)
| head (rank <=10)
| fields rank, host,event, Entity, Count,Total
| eval Entity=mvindex(Entity,0,9)
| eval Count=mvindex(Count,0,9)
| eval Percent=mvindex(Percent,0,9)
| timechart span=1d useother=f count by host
If your saved search has a different time field, then you may need to convert that to _time using strptime.
Thank you so much ,it worked
Timechart requires _time in order to function, but your "stats" commands don't pass _time through. Assuming your saved search includes _time, try this:
| savedsearch "r1"
| bin _time span=1d
| top 10 event by host, _time
| sort-count
| eventstats sum(count) as TotalNumber
| eval PercentOfTotal = round(100 * count / TotalNumber,2). "%"
| stats list(entity) as "Entity" list(count) as "Count", sum(count) as "Total" by event, _time
| sort-Total
| addinfo
| eval rank=1
| accum rank
| sort +num(rank)
| head (rank <=10)
| fields rank, host,event, Entity, Count,Total
| eval Entity=mvindex(Entity,0,9)
| eval Count=mvindex(Count,0,9)
| eval Percent=mvindex(Percent,0,9)
| timechart span=1d useother=f count by host
If your saved search has a different time field, then you may need to convert that to _time using strptime.
Hey jlemley...The above command is not working, its not showing top10,its just listing alphabetically.
Thank you so much ,it worked