Splunk Search

when I use timechart with "sum" why does the graph only show me a graph of events

rogerdpack
Explorer

When using this query:

index=development host=*app.dev.dps "dgs_size" | timechart sum(dgs_size)

It doesn't graph the sum, only the events, what gives?

Tags (2)
0 Karma
1 Solution

rogerdpack
Explorer

Turns out that the "top" graph is always of events, and to see the "real" graph, you need to click the right tiny icon to show it. Odd. See http://twitpic.com/atkfn7

View solution in original post

0 Karma

rogerdpack
Explorer

Turns out that the "top" graph is always of events, and to see the "real" graph, you need to click the right tiny icon to show it. Odd. See http://twitpic.com/atkfn7

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!