Implementing Splunk 7, Third Edition - Third Edition

The timechart options

Timechart has many arguments and formatting options. We'll touch upon a few examples of formatting, but they are too numerous to cover in detail. We will use other chart types in later chapters. Let's throw a few options in (to a simple search) and see what they do:

sourcetype="*" GET | timechart bins=100 limit=3 useother=false  usenull=false count as "Error count" by user 

Let's step through each of these arguments:

• sourcetype="*" GET is our search query.
• bins defines how many bins to slice time into. The number of bins will probably not be exactly 100, as the time will be sliced into logical units. In our example, this comes to 10 minutes per bin. To be more exact, you can use span (for example, span=1h) for hourly ...