Splunk Search

Why can't I plot timechart to investigate seasonality in index data?

POR160893
Builder

Hi,

I am running the following query to check seasonality in my index:
index="ABC
| timechart count by _time | timechart

Error in 'timechart' command: Repeated group-by field '_time'.
The search job has failed due to an error. You may be able view the job in the Job Inspector.However, I am receiving the following error and I do not understand it at all:

Can you please help?
Many thanks!

Labels (2)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @POR160893,

timechart has insede the command the grouping by _time so you don't need to explicitate it, in addition you cannot use timechart command without any function:

index="ABC
| timechart count

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...