Splunk Timechart

The Splunk timechart command is used to produce the summary statistics table. This table, which is generated as a result of the command execution, can then be formatted in a way that is appropriate for the requirement , for example, chart visualization.

The data obtained is plotted against time (which is limited to the X-axis by default) and then the parameter that you choose for the Y-axis in the charts that we try to visualize. The timechart is a statistical aggregation of data from a specific field, with time on the X-axis. As a result, the chart visualizations you may obtain are always line charts, area charts, or column charts.

                          Take your career to next level in Splunk with HKR. Enroll now to get Splunk Training

Kindly Look More Closely at The Syntax Of The TimeChart Command Offered by The Splunk Software:

timechart [sep=] [format=] [partial=] [cont=] [limit=] [agg=] [... ] ( ( [BY ] ) | () BY )

Now let us focus at the needed arguments which you must particularly pass on to the command in order to retrieve the information that you seek. It is mandatory to provide either or when using either or. Let's take a closer look at each and every possible command argument.

  • Eval-expression
Syntax: | | | |

This is a collection of literals, fields, operators, and functions that may or may not represent the value of your destination field. For any of these evaluations to be valid for the operation that we are going to perform on them, the values must be valid for the type of operation that we are going to perform on them.To illustrate, attempting to perform addition or multiplication of two variables with non-numerical inputs will not yield the expected result.

  • Single-agg
Syntax: |  ( )

This would be best composed of a single aggregation which can be applied to any field, such as evaluated fields. Wildcards are not permitted to be used. The field must be specified, and yet while using the count aggregator, it can be alternatively left out.

                                                                    Lets's get started with Splunk Tutorial !

Check out our Tutoral video. Register Now Splunk Online Training to Become an expert in Splunk.

Splunk Training

  • Master Your Craft
  • Lifetime LMS & Faculty Access
  • 24/7 online expert support
  • Real-world & Project Based Learning
  • Split-by-cause
Syntax: ( ) … [ ]

This stipulates a split field. If the supplied field is a numerical field, the default discretization is used (which is defined by the tc-options). You can optionally specify the number of columns that must be included.

There seem to be a variety of custom fields which can be used with the timechart command, but we won't go over them all to save time. Let's look at some of the important but optional parameters in the examples section so we can understand how to use them; if not, they can be safely skipped.

Examples of Splunk Timechart:

Let's take a look at an example using Splunk Timechart.

Now let us search at the hypothesis that we really previously described in the form of examples to understand the nitty gritty details that we may have overlooked earlier.

Example 1:

The report analyzes and visualizes the average indexing throughput (indexing kbps) of Splunk processes over time using internal Splunk log data. The information is then split by the processor as shown below:

index=_internal "group=thruput" | timechart avg(instantaneous_eps) by processor

Example 2:

This example illustrates a chart that multiplies the average CPU and average MEM for each connected host. Calculate the product of the average CPU and average MEM for each host every 10 minutes.

…|timechart span=10m eval(avg(CPU) * avg(MEM)) BY host

Example 3:

This example will show you a graph of the average number of CPU seconds provided by your processor, which will be rounded to four decimal places according to the syntax provided in the example below.

... | timechart eval(round(avg(cpu_seconds),4)) BY processor

Subscribe to our youtube channel to get new updates..!

Example 4:

This example will take the average value of CPU utilization for each single minute for each available host and generate a beautiful chart displaying the average CPU utilization for each host.

…| timechart span=1m avg(CPU) BY host

Example 5:

This example will calculate the average of cpu seconds by every available host and then remove any outlier values that may distort the time-chart axis of the generated chart.

| timechart avg(cpu_seconds) BY host | outlier action=tf

Example 6:

This example will detail the average throughput of all available hosts over longer periods of time in a nice chart with average throughput against hosts over time.

 | timechart span=10m avg(thruput) BY host

Example 7:

In a chart, this case illustrates the counts of event types recognized by the source ip field where the count evaluated is greater than 25.

sshd failed OR failure | timechart span=10m count(eventtype) BY source_ip usenull=f WHERE count>25

                                                  Explore Splunk Sample Resumes! Download & Edit, Get Noticed by Top Employers! 

Splunk Training

Weekday / Weekend Batches


The above blog post mainly focused on informing us of all the characteristics readily accessible by Splunk software, but in an effort to comprehend all these, we had also gone into greater detail on Splunk Timechart. We also went over an example about how to use Splunk Timechart and described how and when to use it. Had any doubts drop your queries in the comments section to get thm clarified.

Other Blogs:

Find our upcoming Splunk Training Online Classes

  • Batch starts on 28th Sep 2023, Weekday batch

  • Batch starts on 2nd Oct 2023, Weekday batch

  • Batch starts on 6th Oct 2023, Fast Track batch

Global Promotional Image


Request for more information

Research Analyst
As a senior Technical Content Writer for HKR Trainings, Gayathri has a good comprehension of the present technical innovations, which incorporates perspectives like Business Intelligence and Analytics. She conveys advanced technical ideas precisely and vividly, as conceivable to the target group, guaranteeing that the content is available to clients. She writes qualitative content in the field of Data Warehousing & ETL, Big Data Analytics, and ERP Tools. Connect me on LinkedIn.