Hi,
I am joining several source files in splunk to degenerate some total count. One thing to note is I am using ctcSalt= to reindex all my source file to day, as only very few files will be chnaged when compared to other and i need to reindex all the files as per my usecase.
Here I start using | stats count | timechart span=1d count(field) at the end of of the string and it does not provide any results, i also tries xyseries still no results.
How do i span the results for each day?
↧