Hi @ all,
how could I create a timechart if I have just a error message and no field value?
For example:
index="*" thisistheerrormessage | timechart thisistheerrormessage span=1h
Thanks and BR,
Michael
@123michi19 Count the events and chart when those event happened over time like this:
index="*" thisistheerrormessage | timechart span=1h count
@123michi19 Count the events and chart when those event happened over time like this:
index="*" thisistheerrormessage | timechart span=1h count
Thanks for your answer. That works fine. The only problem for me is: I see as describer in the timechart the word "count". How can I get the error message instead of count?
BR
Try the following:
| timechart span=1h count as "thisistheerrormessage"
Yes, that's fantastic.
Thanks both for your help 🙂
Anytime 🙂