hi all ,
I used the below query ..but i am not getting the timechart its shows
field '_time' should have numerical values
| savedsearch "searchduration" | join TaskBP [ | savedsearch "searchavgduration" ]|eval
Difference=duration-Avgduration|where (Difference>-90 AND Difference<90)| table _time TaskBP Difference | timechart count(Difference) by TaskBP
i have used the tonumber and auto function ..still i am getting error
Thanks
Poornima
What's the idea of having the table
command there?! That's what's causing your error. table
will implicitly convert the _time
value to something humanly readable, which is incompatible with what timechart
expects.
Splunkpoornima, please please please stop reposting questions, let it flow and grow within the one question! http://splunk-base.splunk.com/answers/66695/timechart-errror It just confuses things if others search for answers in the future and people trying to help won't know what you've already been told!
There you go - your stats
at the end of the second saved search will remove the _time
field altogether.
savedsearch -searchduration has the query
source="taskmanager_log.txt"|transaction TaskBP startswith=START endswith=Succeeded
savedsearch -searchavgduration has the query
source="task.txt"| transaction TaskBP startswith=START endswith=Succeeded|stats avg(duration) as Avgduration by TaskBP
Well what is the output of the saved search?
hi ayn,
i tried without using the table command also but again it shows the same error as above