timechart

[mm12]

Hi,

I am just taking the total count of incident using stats command form the json and the query is working fine. But when I using timechart command it is not giving me the visualization. Please anyone help me on this.

index=incident_index  source="/mi_data/dc_in_events.json" | spath path=Incident__Number output=INC | stats values(*) as * by INC | stats count(Incident__Number)

Thanks

[PickleRick]

How are you trying to add timechart to this search?

You're already doing stats and getting a single number so there is nothing to make timechart from.

BTW, you calculate stats values(*) but then only use one of those fields. Instead of doing all this, just doing

| stats dc(Incident_Number)

Instead of both stats would be enough.

About the timechart - it's not clear what you want to do. Can you explain it?

[mm12]

@PickleRick - I am using below query for time chart instead of stats command but it is not working.

index=incident_index  source="/mi_data/dc_in_events.json" | spath path=Incident__Number output=INC | stats values(*) as * by INC | timechart count 

Thanks

[PickleRick]

Well, if you do your stats, you lose the _time field because you're aggregating data over values of INC. You might have a multivalued field containing all values of _time in one row but that's just one row, so there's no basis for timechart.

What do you want to chart? Tell us with your own words, not with SPL.