timechart command: Examples

The following are examples for using the SPL2 timechart command.

1. Charting the count for each host in 1 hour increments

For each hour, calculate the count for each host value.

CODE 
...| timechart span=1h count() by host

2. Charting the average of "CPU" for each "host"

For each minute, calculate the average value of "CPU" for each "host".

CODE 
... | timechart span=1m avg(CPU) BY host

3. Charting the product of two averages for each host

For each minute, calculate the product of the average "CPU" and average "MEM" and group the results by each host value. This example uses an <eval-expression> with the avg stats function, instead of a field.

CODE 
... | timechart span=1m eval(avg(CPU) * avg(MEM)) BY host

4. Charting the average of cpu_seconds by processor

Create a timechart of the average of cpu_seconds by processor, rounded to 2 decimal places.

CODE 
... | timechart eval(round(avg(cpu_seconds),2)) BY processor

5. Charting the average "thruput" of hosts over time

Create a timechart of the average of the thruput field and group the results by each host value.

CODE 
... | timechart span=5m avg(thruput) BY host

6. Aligning the chart time bins to local time

Align the time bins to 5 AM at local time. Set the span to 12h. The bins will represent 5 AM to 5 PM, then 5 PM to 5 AM the next day, and so on.

CODE 
...| timechart _time span=12h aligntime=@d+5h