How to edit my timechart search to find how many fields were processed in a given time span?

[prashanthberam]

i have table like this

id            info            starttime    endtime      responsetime    source
2             inbound         time1        time2        1sec            raja
              outbound
3             inbound         time3        time4        3 sec           raja1
              outbound

i need to find out the timechart; like in 1 hr, how many id's were processed in 24 hrs
i am trying to do timechart span=1h count(id) by source
but I am getting error, could someone please help me?
thanks.

[somesoni2 · Accepted solution]

Try this (check the rex command as it was truncated in your comments)

index=**** source="****" "getProcedureDetailBlueChip" OR "getProcedureDetailBlueChipResponse" AND 
 "Outbound Message" OR "Inbound Message" OR "getProcedureDetailBlueChip response time returning procedure details" OR "memZipCode assigned to zipCode" OR 
 "provZipCode assigned to zipCode" OR "Begin getProcedureDetailBluChip"|rex "(?Inbound|Outbound)" | rex "ID:(?.*)" 
 |rex "(?m)\(?.*)"|rex "(?m)\(?.*)" | timechart span=1h dc(id) by source

[somesoni2]

The timechart command requires field _time to be present in the resultset. Which field can be used to calculate _time?

[prashanthberam]

index=**** source="****" "getProcedureDetailBlueChip" OR "getProcedureDetailBlueChipResponse" AND 
"Outbound Message" OR "Inbound Message" OR "getProcedureDetailBlueChip response time returning procedure details" OR "memZipCode assigned to zipCode" OR 
"provZipCode assigned to zipCode" OR "Begin getProcedureDetailBluChip"|rex "(?Inbound|Outbound)" | rex "ID:(?.*)" 
|rex "(?m)\(?.*)"|rex "(?m)\(?.*)"
|stats max(_time) as startTime,min(_time) as endTime,values(info) as Info,values(ResponseTime) as responseTime,values(StatusCode) as StatusCode,values(message) as StatusMessage by id,source
|eval responseTime=startTime-endTime |eval StartTime=strftime(startTime,"%Y-%m-%d %H:%M:%S,%3N")|eval EndTime=strftime(endTime,"%Y-%m-%d %H:%M:%S,%3N")
|table id,Info,StartTime,EndTime,responseTime,StatusCode,StatusMessage,source

my query like this i am trying to put the _time field in it , could you please suggest me..thanks...