Splunk Search

timechart without spaning

sbsbb
Builder

I would like to show the message_types from each event on a timeline.

I think timechart would be the right element, but is there a way to specify that it shoud not span ?

index=t | head 10 | timechart list(H_message_type) [[NOSPAN ?]]

Tags (2)
0 Karma

jonuwz
Influencer

you dont have to use timechart. xyseries can do it too, and you dont specify a span, or an aggregating function

i.e.

index=_internal group="per_sourcetype_thruput"  | xyseries _time series ev

if you dont have a series (a "by" clause - the 2nd arg to xyseries), you need to make a dummy one.

index=_internal | eval wibble="suasages" | xyseries _time wibble bytes
0 Karma

gfuente
Motivator

Hello

Have you tried just:

index=t | head 10 |   timechart count by H_message_type

Regards

0 Karma

MuS
SplunkTrust
SplunkTrust

use this:

index=t | head 10 | timechart span=1ms list(H_message_type)

this should provide the correct chart .... at least it did for me with 5.0.1

cheers, MuS

0 Karma

sbsbb
Builder

splunk is still putting events together... _time difference is in ms...
I tried with span=1cs, but doesn't work :

[SimpleResultsTable module] invalid literal for int() with base 10: '0.01'

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...