timechart

This command creates a time-series representation of data in the form of a table of statistics and a corresponding chart based on the field or fields specified.

You can run this command with:

• Time span in days, minutes, or hours
• Aggregate functions such as count, sum, or average

The starting and ending points to create the chart are defined by the time range used before you run the command. The time span defined as a part of the command acts as a bucketing option to specify the number of buckets into which you want to divide the data to plot a data point.

You can perform advanced analysis by running this command to group data by a field so that each distinct value of the field acts as an additional grouping. For example, you can plot the count of data occurring from a particular host depending on the data-collector names for the time span specified.

Syntax

In the preceding syntax, the following definitions apply:

• + indicates one or more similar expressions separated by a comma (,) or space.
• [expression] indicatesit is optional.
• <duration> refers to an integer value to indicate the time-span bucket.

• <timescale> refers to a time scale such as days, hours, or minutes.

  The following table describes the time scale options that can be used in the command syntax:

  Item	Syntax
  Minutes	m | min | mins | minute | minutes
  Hours	h | hr | hrs | hour | hours
  Days	d | day | days

• <aggregate-function> refers to the aggregate function used for creating the chart; for example, count, sum, or average.

  The following table describes the aggregate functions that can be used in the command syntax:

  Function	Syntax	Description
  Count	count (<field>)	Uses field name as an argument and returns the number of occurrences of that field in the search results.
  Sum	sum (<field>)	Uses field name as an argument and returns the sum of values of that field in the search results.
  Average	avg (<field>)	Uses field name as an argument and returns the average of values of that field in the search results.
  Minimum	min (<field>)	Uses field name as an argument and returns the smallest value of that field.
  Maximum	max (<field>)	Uses field name as an argument and returns the highest value of that field.
  where, <field> can be a field name or a tag name

• by <field> refers to the group by parameter optionally used in conjunction with the aggregate functions to group the result set by the specified field.

Short examples

Example 1: Display a table of statistics (and a multiseries chart) displaying an aggregation of the distinct HOST field values against each day.

Example 2: Display a table of statistics (and a multiseries chart) displaying an aggregation of the RequestType field values that occurred in the span of 1 hour.

... | timechart span=1hr count(RequestType)

Example 3: Display a table of statistics (and a multiseries chart) displaying an aggregation of the RequestType field values that occurred in the span of 1 hour and grouped by the ClientIp field.

Example 4: Display a table of statistics (and a multiseries chart) displaying an aggregation of the RequestType field values that occurred in the span of 1 hour, plus a sum and average of the ResponseSize field values.

Example 5: Display a table of statistics (and a multiseries chart) displaying an aggregation of the RequestType field values that occurred in the span of 1 hour, plus the sum and average of the ResponseSize field values, grouped by the ClientIP field.

Long examples

The following sample data and sample indexed data (displayed on the Search tab) will help you understand the examples of using the timechart command.

• Sample data
•  
• Sample indexed data
• count
• count with by parameter
•  
• count, sum, and avg
•  
• count, sum, and avg with by parameter
•  
• min
• max
• min with by parameter
•  
• min, max, and avg
•  

Sample data

Back to examples ↑

Sample indexed data

Back to examples ↑

count

In this example, you use the command to see a table of statistics (and a multiseries chart) displaying an aggregation of the RequestType field values that occurred in the span of 1 hour.

Command

Output

Back to examples ↑

count with by parameter

In this example, you use the command to see a table of statistics (and a multiseries chart) displaying an aggregation of the RequestType field values that occurred in the span of 1 hour and grouped by the ClientIp field.

Command

Output

Back to examples ↑

count, sum, and avg

In this example, you use the command to see a table of statistics (and a multiseries chart) displaying an aggregation of the RequestType field values that occurred in the span of 1 hour, plus a sum and average of the ResponseSize field values.

Command

Output

Back to examples ↑

count, sum, and avg with by parameter

In this example, you use the command to see a table of statistics (and a multiseries chart) displaying an aggregation of the RequestType field values that occurred in the span of 1 hour, plus the sum and average of the ResponseSize field values, grouped by the ClientIP field.

Command

Output

Back to examples ↑

min

In this example, you use the command to display the minimum value (smallest value) of the ResponseSize field.

Command

Output

Back to examples ↑

max

In this example, you use the command to display the maximum value (highest value) of the ResponseSize field.

Command

Output

Back to examples ↑

min with by parameter

In this example, you use the command to display the minimum value (smallest value) of the ResponseSize field, grouped by the ClientIp field. By running this command, you can understand the hosts from where minimum values are derived.

Command

Output

Back to examples ↑

min, max, and avg

In this example, you use the command to display the minimum (smallest), maximum (highest), and average of the ResponseSize field values.

Command

Output

Back to examples ↑

Notes

• If the data contains an event with no time stamp, the product assigns a time stamp to that event at the time of indexing. The same time stamp is used for displaying the time bucket when you run this command.
• You cannot run this command to display more than 100 buckets.
• While using the sum and avgfunctions in your search syntax, the following conventions apply:
  • If the timechart command is the first command after the initial search query, the fields specified in the sum and avg functions must be of the field type INTEGER or LONG.
    The field type can be specified while creating a data pattern.
  • If the timechart command is preceded by another search command, the fields specified in the sum and avg functions must be numbers.