I'm creating a summary report based on a timechart that counts the number of eventcounts for a certain transaction.
index=xpto | transaction maxspan=2m maxpause=30s fields=correlation | sitimechart count by eventcount
This creates events on my summary index with this structure.
05/02/2013 13:59:00 +0100, search_name="sessions by eventcount - summary", search_now=1367503200.000, info_min_time=1367496000.000, info_max_time=1367499600.000, info_search_time=1367503201.529, 1=0, 2=0, 3=0, 4=7, 7=0, report="sessions"
How can I extract the summary to chart the initial graph?
You basically replace everything before the si command with a search for the summary results and then add the reporting command without the si. So yours becomes
Index=summary search_name="sessions by eventcount - summary" | timechart count by eventcount
Bob
You basically replace everything before the si command with a search for the summary results and then add the reporting command without the si. So yours becomes
Index=summary search_name="sessions by eventcount - summary" | timechart count by eventcount
Bob
Yes it works the problem was, that I didn't have the sitimechart funcion on the schedulled search.
After correcting this I was able to access the data.