Search commands - chart and timechart
The chart
command is an aggregation command that provides output in tabular or chartable format. It is a very important command that is used for many different types of visualization. Notice that if you run the following search query, it is identical to the output of the stats
command:
SPL> index=main | chart count by method
For all basic purposes, you can use stats
and chart
interchangeably. However, there will be differences in how stats
and chart
group data together. It will be up to you to determine which one is your intended result. To show the differences, here are some examples:
SPL> index=main | stats count by method url
SPL> index=main | chart count by method url
The timechart
command, on the other ...
Get Splunk: Enterprise Operational Intelligence Delivered now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.