Hi Splunkers,
How to add or SUM values in timechart as shown below:
Search I used:
base search|transaction....|timechart sum(duration) as duration by stage
Below is my current output:
_time stage1 stage2 stage3
2016-08-09 09:40:00 10
2016-08-09 09:43:00 4 1
2016-08-09 09:44:00 5 2
2016-08-09 09:48:00
Expected output:
_time stage1 stage2 stage3
2016-08-09 09:40:00 15
2016-08-09 09:43:00 4 3
2016-08-09 09:44:00
2016-08-09 09:48:00
Thanks
↧