Dashboards & Visualizations

Create timechart without a field name

123michi19
Explorer

Hi @ all,

how could I create a timechart if I have just a error message and no field value?

For example:
index="*" thisistheerrormessage | timechart thisistheerrormessage span=1h

Thanks and BR,
Michael

Labels (1)
Tags (1)
0 Karma
1 Solution

efavreau
Motivator

@123michi19 Count the events and chart when those event happened over time like this:
index="*" thisistheerrormessage | timechart span=1h count

###

If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

efavreau
Motivator

@123michi19 Count the events and chart when those event happened over time like this:
index="*" thisistheerrormessage | timechart span=1h count

###

If this reply helps you, an upvote would be appreciated.
0 Karma

123michi19
Explorer

Thanks for your answer. That works fine. The only problem for me is: I see as describer in the timechart the word "count". How can I get the error message instead of count?

BR

0 Karma

niketn
Legend

Try the following:

| timechart span=1h count as "thisistheerrormessage"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

123michi19
Explorer

Yes, that's fantastic.
Thanks both for your help 🙂

niketn
Legend

Anytime 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...