Skip to main content

timechart

Description

Performs search and generates an array of data distributed along a timeline.

Syntax

timechart [<timefield>] [<limit>] [<span>] [<bins>] [<useother>] <functions-expression> ["," <functions-expression>] [<by_expression>]

Required Arguments

functions-expression You must use at least one of the following functions:

ParameterSyntaxDescription
countcount | count(<field>)Computes the count of events containing a field. If no field is specified, calculates the total number of events.
avgavg(<field>)Computes the average value for a given field.
dcdc(<field>)Computes the number of unique values in a given field.
maxmax(<field>)Computes the maximum value for a given field.
minmin(<field>)Computes the minimum value for a given field.
sumsum(<field>)Computes the sum of the values in a given field.

Optional Arguments

ParameterSyntaxDefaultDescription
spanspan=<span>see predefined span valuesDefines the interval for segment distribution.
timefieldtimefield=<field>@timestampThe field name where the timestamp is stored.
binsbins=<int>100The maximum number of segments for computation.
limitlimit=<int>10The maximum number of unique by_field values that can be used in the column names of the result. Remaining values will be merged into the OTHER field.
useotheruseother=<boolean>trueIf set to false, the limit parameter is ignored.
by_expressionby <field>The field name for grouping values.

The following time formats are allowed: (+|-)<int>(s|m|h|d|w|month):

  • s/sec/secs/second/seconds - seconds
  • m/min/mins/minute/minutes - minutes
  • h/hr/hrs/hour/hours - hours
  • d/day/days - days
  • w/week/weeks - weeks
  • mon/month/months - months
Predefined span values

If the span parameter is not specified for the time field, predefined parameters will apply.

Here's the list of predefined parameters:

Time Intervalspan
last 15 minutes10 seconds
last 60 minutes1 minute
last 4 hours5 minutes
last 24 hours30 minutes
last 7 days1 day
last 30 days1 day
last year1 month

Query Examples

Example 1:

Example #1
... | timechart limit=5 span=1h avg(msgNums) by user

Example 2:

Example #2
... | timechart limit=5 span=1d avg(log.offset) by 'source'

Example 3:

Example #3
... | timechart span=1d count(log.offset), max(log.offset) by event