Splunk Search

How to use timechart with stats and eval command

sunnyparmar
Communicator

Hi,

My query is below -

index=abc sourcetype=xyz Unable to connect to the remote server | Stats count(eval("Unable to connect to the remote server")) as "Error" by host

In this query how can I use (timechart span=1h) function? Any suggestions would be appreciated..

Thanks

Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

Your eval is wrong and redundant; try this:

index=abc sourcetype=xyz Unable to connect to the remote server | timechart span=1h count AS "Error" by host

View solution in original post

woodcock
Esteemed Legend

Your eval is wrong and redundant; try this:

index=abc sourcetype=xyz Unable to connect to the remote server | timechart span=1h count AS "Error" by host

sunnyparmar
Communicator

thanks... that's cool..

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...