sitimechart
Summary indexing is a method you can use to speed up long-running searches that do not qualify for report acceleration, such as searches that use commands that are not streamable before the transforming command. For more information, see "About report accelleration and summary indexing" and "Use summary indexing for increased reporting efficiency" in the Knowledge Manager Manual.
Description
The sitimechart
command is the summary indexing version of the timechart
command, which creates a time-series chart visualization with a corresponding table of statistics. The sitimechart
command populates a summary index with the statistics necessary to generate a timechart report. After you use an sitimechart
search to populate the summary index, use the regular timechart
command with the exact same search string as the sitimechart
search to report against the summary index.
Syntax
The required syntax is in bold.
- sitimechart
- [sep=<string>]
- [partial=<bool>]
- [cont=<bool>]
- [limit=<int>]
- [agg=<stats-agg-term>]
- [<bin-options>... ]
- <single-agg> [BY <split-by-clause>] | <eval-expression> BY <split-by-clause>
When specifying sitimechart
command arguments, either <single-agg> or <eval-expression> BY <split-by-clause> is required.
For descriptions of each of these arguments, see the timechart command.
Usage
Supported functions
You can use a wide range of functions with the sitimechart
command. For general information about using functions, see Statistical and charting functions.
- For a list of functions by category, see Function list by category
- For an alphabetical list of functions, see Alphabetical list of functions
Examples
Example 1:
Use the collect
command to populate a summary index called mysummary
with the statistics about CPU usage organized by host,
... | sitimechart avg(cpu) BY host | collect index=mysummary
The collect
command adds the results of a search to a summary index that you specify. You must create the summary index before you invoke the collect
command.
Then use the timechart
command with the same search to generate a timechart report.
index=mysummary | timechart avg(cpu) BY host
See also
sistats | sitop |
This documentation applies to the following versions of Splunk Cloud Platform™: 8.2.2112, 8.2.2201, 8.2.2202, 8.2.2203, 9.0.2205, 9.0.2208, 9.0.2209, 9.0.2303, 9.0.2305, 9.1.2308, 9.1.2312, 9.2.2403 (latest FedRAMP release), 9.2.2406
Feedback submitted, thanks!