timechart command overview

The SPL2 timechart command creates a time series chart with a corresponding table of statistics.

A timechart is a aggregation applied to a field to produce a chart, with time used as the X-axis. You can specify a split-by field, where each distinct value of the split-by field becomes a series in the chart.

Syntax

The required syntax is in bold.

timechart

[sep=<string>] [format=<string>] [partial=<boolean>] [cont=<boolean>] [fixedrange=<boolean>] [limit=<int>]

[agg=<aggregation>] [<bin-options>... ]

( (<single-aggregate> [BY <split-by-clause>] ) | (<eval-expression>) BY <split-by-clause> ) )

You must specify either a <single-aggregate> or an <eval-expression> with a BY clause.

See also

timechart command

timechart command syntax details

timechart command usage

timechart command examples

Functions

Overview of SPL2 stats and chart functions

Related information

timewrap command overview