sitimechart
sitimechart
Use the summary indexing reporting commands (sichart, sitimechart, sistats, sitop, and sirare) to define the search that will populate the summary index. If you use these commands, you can use the same search string for the search that you eventually run on the summary index, with the exception that you use regular reporting commands (chart, timechart, stats, top, and rare, respectively) in the latter search.
Read more about the summary indexing reporting commands in "Use summary indexing for increased reporting efficiency" topic of the Knowledge Manager Manual.
Synopsis
Summary indexing version of the timechart command.
Syntax
sitimechart timechart_syntax
Arguments
Refer to the timechart command syntax.
Description
Summary indexing friendly versions of timechart command, using the same syntax. Does not require explicitly knowing what statistics are necessary to store to the summary index in order to generate a report.
Does require the timechart command used to process this data have the exact same arguments as were used with the sitimechart command to generate the data.
Examples
Example 1: Compute the necessary information to later do 'timechart avg(foo) by bar' on summary indexed results.
... | sitimechart avg(foo) by barSee also
collect, overlap, sichart, sirare, sistats, sitop
Answers
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the sitimechart command.
This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 , 5.0 , 5.0.1 , 5.0.2 , 5.0.3 View the Article History for its revisions.