Splunk Search

timechart not showing any result while tstat does

unitrium
Explorer

Hi ,

I'm trying to build a single value dashboard for certain metrics. I would like to put it in the form of a timechart so I can have a trend value.

However this search gives me no result :

 

 

 

| tstats `summariesonly` min(_time) as firstTime,max(_time) as lastTime,count from datamodel=Vulnerabilities.Vulnerabilities by Vulnerabilities.signature,Vulnerabilities.dest, Vulnerabilities.severity | `drop_dm_object_name("Vulnerabilities")` | where firstTime!=lastTime AND severity!="informational" | eval age=round((lastTime-firstTime)/86400) | timechart span=30d avg(age) by lastTime

 

 

 


Which is strange because I feel like this command is almost the same :

 

 

 

| tstats `summariesonly` min(_time) as firstTime,max(_time) as lastTime,count from datamodel=Vulnerabilities.Vulnerabilities by Vulnerabilities.signature,Vulnerabilities.dest, Vulnerabilities.severity | `drop_dm_object_name("Vulnerabilities")` | where firstTime!=lastTime AND severity!="informational" | eval age=round((lastTime-firstTime)/86400) | bucket lastTime span=30d | stats avg(age) by lastTime

 

 

 

And this one returns me the results that I want. Could anybody help me out getting a timechart out of this ?

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

timechart is looking to use _time so try

... | eval age=round((lastTime-firstTime)/86400) | eval _time=lastTime | timechart span=30d avg(age)

 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

timechart is looking to use _time so try

... | eval age=round((lastTime-firstTime)/86400) | eval _time=lastTime | timechart span=30d avg(age)

 

Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...