Here is my search manager:
var search1 = new SearchManager({
id: "rtCPUDaySearch",
earliest_time: "rt-24h",
latest_time: "rt",
autostart: true,
search: host="AAAAAAAAAAAAAAAAA"| bin _time span=2m | stats first(pctSystem) by _time | sort -_time',
preview: true,
cache: false
});
Here is my chart view:
new ChartView({
id: "element2",
managerid: "rtCPUDaySearch",
type: "line",
"charting.legend.placement": "bottom",
el: $("#myLineChart")
}).render();
Here is the result:
This is determined by the search you run. You have two options here: either you bucket _time in hour buckets, or (and I would recommend this) you use timechart
instead of bucketing and stats. Your search would look like this with timechart:
host="AAAAAAAAAAAAAAAAA"| timechart span=1h first(pctSystem)
Or like this with bucket:
host="AAAAAAAAAAAAAAAAA"| bin _time span=1h | stats first(pctSystem) by _time | sort -_time
This is determined by the search you run. You have two options here: either you bucket _time in hour buckets, or (and I would recommend this) you use timechart
instead of bucketing and stats. Your search would look like this with timechart:
host="AAAAAAAAAAAAAAAAA"| timechart span=1h first(pctSystem)
Or like this with bucket:
host="AAAAAAAAAAAAAAAAA"| bin _time span=1h | stats first(pctSystem) by _time | sort -_time