Splunk 7.x Quick Start Guide

Timechart

A timechart is a statistical aggregation applied to a field to produce a chart, with time used as the X-axis. You can specify a column split-by field, where each distinct value of the split-by field becomes a series in the chart. If you use an eval expression, the split-by clause is required.

Here is an example of using the timechart command (and an example of a timechart visualization is depicted in Fig 6.11):

index=_internal source=*metrics.log group=per_source_thruput | timechart span=5m avg(kbps) by host

You can use a span option with timechart to control the time increments for each bin of values the statistical function operates over.

Note that you can pipe a properly formatted table to the stats, chart, and timechart commands; ...