@sundareshr Thank you very much. ... View more

@niketnilay Thanks. I've tried your suggestion in my query. And it work that when i click the point it will redirect me to another page with a new search. But when i drag and select multi points in chart, it only zoom the chart. So, my real need is that the table show events queried according to the time of the point clicked or the time range of the points selected by drag. ... View more

@sundareshr Thank you for answer my question and give me support again. I've glance over the token. And it was like programming language variables. My difficulty is that i don't know how to response to a "click" or "select" in timechart? It means when i click in the chart, a table should display under the chart. The table show the information of the point clicked by me in chart . ... View more

*@sundareshr Sorry. I think the "timechart span=1h count" only counts the task created and not started in a time range of [-k,-k+1]hour. so,it was not from -24houes. but a time span of a hour. Do you agree? * ... View more

*@sundareshr Thanks. I've tried your query in splunk, the query get the results like before. * my query now: index="index_xxx" (category=Created OR category="Started") earliest=-1d | eval taskRequestId=coalesce(taskRequestId, id) | eventstats dc(category) as nbr_categories by taskRequestId | where nbr_categories=1 | timechart span=1h count It works in my splunk search, gets the created tasks number in time range [-1d,now]. But not [-24,-23] hours, [-24,-22] hours and [-24,-21]...chart. Can the "timechart span=1h count" be changed to make what i need? @sundareshr Thank you very much! ... View more

*@sundareshr Thanks. I've tried your query in splunk, the query get the created tasks number for each hour. But it didn't judge whether the task is started. The dc(category) is that you put to make it? but index="acadci_wk_prod" category=taskCreated make dc(category) always "1". So the query get the created tasks number for each hour. I try to delete the "category=taskCreated", but i find that there is another trouble made by my own. The taskId named different at two events that it call "id" in created tasks,but "taskRequestId" in started tasks. Is that ok not changing the log script in the machine but still complete what i need? Thanks! * what i do: ``` index="index_xxx" category=Created earliest=-1d | eval taskRequestId=id | eventstats dc(category) as nbr_categories by taskRequestId | where nbr_categories=1 | timechart span=1h count ``` It work in my splunk search, get the created tasks number for each hour. @sundareshr Thank you very much! ... View more

@sundareshr Thanks. I've tried your query in splunk, but there is a error. There are some background features of this problem i need to tell you. So if you got it, i would appreaciated that you give me some advices to solve this problem! Features A task has two category but shares only one taskId. And the task in splunk index has two events by different category that is either category=Created or category=Started. A task is created first and then started. Not every task is started just after created. So i need to i need to know the sum of tasks created but not started in [-24,-23], [-24,-22] and [-24,-21] ... [-24,now] hour. After i draw the chart, i can know the change trends of how many tasks created but not started. My query can just show the sum of tasks created but not started in [-24,now]hour. That troubled me. index="index_kkk" category=Created earliest=-1d | search NOT [search index="index_kkk" AND category=Started earliest=-1d | fields taskId ] | timechart count span=1h | streamstats sum(count) as cumulative Is that clear for you? Could you give me some advices? Thank you very much! ... View more