Implementing Splunk 7, Third Edition - Third Edition

Using timechart

The simplest approach to counting events over time is simply to use timechart, like this:

sourcetype=impl_splunk_gen network=prod 
| timechart span=1m count 

In the table view, we see the following:

Charts in Splunk do not attempt to show more points than the pixels present on the screen. The user is, instead, expected to change the number of points to graph, using the bins or span attributes. Calculating average events per minute or per hour shows another way of dealing with this behavior.

If we only wanted to know about the minutes that actually had events instead of every minute of the day, we could use bucket and stats