Splunk Search

tstat and timechart

rizzo75
Path Finder

tscollect was leveraged to put data into time series index files. I am able to use tstat to calculate statistics. How would I go about leveraging timechart with tstat?

Here is what I want to work:
| tstats prestats=t field1, field2, field3 FROM my_ns | timechart avg(field1) by field2

What am I missing?

Thanks,
Joe

Tags (2)

Lamar
Splunk Employee
Splunk Employee

Joe,
Try using this:

| tstats prestats=t count as count FROM my_ns groupby field1,field2,field3,_time | timechart avg(field1) as field1_avg by field2
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...