Hi,
I have scenario like having timechart to show spikes for different dates(ex for 7 days).But now it shows same value for all 7 days.
I have intro_max_time and intro_min_time in the format (1477480327.000 which pertains todays date).The condition which i gave is eval _time=info_max_time which takes only today data (ie intro_max_time) .
I want to write this eval function for comparing the data for all the days between this intro_max_time and intro_min_time for getting the spikes.
Please suggest me .
As long as your events have correct values for _time
field, you don't need | addinfo | eval _time=intro_max_time
. Try this instead.
index=foo sourcetype=bar | timechart span=1d cont=t count by remark_status
As long as your events have correct values for _time
field, you don't need | addinfo | eval _time=intro_max_time
. Try this instead.
index=foo sourcetype=bar | timechart span=1d cont=t count by remark_status
i am getting no results .
what is the use of cont=t ???
cont: Specifies whether the chart is continuous or not. If set to true, the Search application fills in the time gaps
. What do you get when you run this query
index=foo sourcetype=bar earliest=-7d@d | dedup _time | table _time remark_status _raw
http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Timechart
Please share your query.
| addinfo | eval _time=intro_max_time |timechart span=1d count by remark_status .
iam selecting time range as last 7 days..