Hi
This is my current search:
chart count(TYPE) over TYPE by _time
I only get 10-12 columns, the rest is put in Other.
All columns are headed with the epoch start of day. Is it possible to get this as strptime()
with unlimited columns?
thanks
You want the time field to be the columns? Eval _time in to a new field, like in this run anywhere example:
index=_internal earliest=-1m
| eval time=strftime(_time,"%Y/%m/%d %H:%M:%S")
| chart limit=0 count(sourcetype) over sourcetype by time
If you want to mimic the span argument to timechart, and aggregate the time ranges you are using for columns, you can use bin first, like so:
index=_internal earliest=-1m
| bin _time span=10s
| eval time=strftime(_time,"%Y/%m/%d %H:%M:%S")
| chart limit=0 count(sourcetype) over sourcetype by time
You want the time field to be the columns? Eval _time in to a new field, like in this run anywhere example:
index=_internal earliest=-1m
| eval time=strftime(_time,"%Y/%m/%d %H:%M:%S")
| chart limit=0 count(sourcetype) over sourcetype by time
If you want to mimic the span argument to timechart, and aggregate the time ranges you are using for columns, you can use bin first, like so:
index=_internal earliest=-1m
| bin _time span=10s
| eval time=strftime(_time,"%Y/%m/%d %H:%M:%S")
| chart limit=0 count(sourcetype) over sourcetype by time
Thanks jplumsdaine22, Worked like a dream.
Sorry I meant unlimited collumns, not rows (which is controlled with limit=0)