can you try this: index=_internal | timechart count | eval _time=strftime(_time,"%m/%d") | outputcsv hola ... View more

@fzfeng, can you try | convert ctime(_time) please, that work for me: index=_internal | timechart span=1d count(eval(log_level=INFO)) as countInfo | convert ctime(_time) | outputcsv tst.csv ... View more

Have a look at the collect command: http://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Collect ... View more

thank you very much it works ... View more

@baoamin, you can try this, you can paste all this request in your sarch bare, index=_internal | timechart span=1h count | eval day=strftime(_time,"%Y-%m-%d") | eventstats max(count) as max by day | where count=max | fields _time, count Try by this to test your request: index=mailog relay=10.204.0.0 | timechart span=1h count | eval day=strftime(_time,"%Y-%m-%d") | eventstats max(count) as max by day | appendcols [search index=mailog relay=10.203.0.0 | timechart span=1h count | eval day=strftime(_time,"%Y-%m-%d") | eventstats max(count) as max by day] ... View more

@fzfeng, if you want count based on various size data taken for a month you can try one of the following: Option 1: Using transpose command index=maillog size=* | stats count(eval(size<1024)) as "<1024" count(eval(size>1024 AND size<2048)) as "1024> & <2028" count(eval(size>2048)) as ">2048" | transpose column_name="size_range" | rename "row 1" as count Option 2: Using stats on range index=maillog size=* | stats count by size | eval size_range=case((size<1024),"<1024",(size>1024 AND size<2048),"1024> & <2028",(size>2048),">2048") | stats count by size_range Please try out and confirm! ... View more

@fzfeng you need to run the query similar to the way you are running timechart for every hour with single timechart command. index=maillog IP1 | timechart span="1h" count Then turn on Show Data Values as Min/Max from format visualization. Or from Simple XML Chart configuration set the following: <option name="charting.chart.showDataLabels">minmax</option> This will put a label on span with Minimum and Maximum Value in a Day. ... View more