Splunk Search

Why can't I plot timechart to investigate seasonality in index data?

POR160893
Builder

Hi,

I am running the following query to check seasonality in my index:
index="ABC
| timechart count by _time | timechart

Error in 'timechart' command: Repeated group-by field '_time'.
The search job has failed due to an error. You may be able view the job in the Job Inspector.However, I am receiving the following error and I do not understand it at all:

Can you please help?
Many thanks!

Labels (2)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @POR160893,

timechart has insede the command the grouping by _time so you don't need to explicitate it, in addition you cannot use timechart command without any function:

index="ABC
| timechart count

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...