timechart

Calculates the result of the aggregate function for every specified time span. If you specify a group field using the by clause, the field is created as a group field value and the statistics for each field are calculated.

Syntax

timechart span=INT{y|mon|w|d|h|m|s} AGGR_FUNC() [as ALIAS], ... [by GRP_FIELD, ...]
Required Parameter
span=INT{y|mon|w|d|h|m|s}
Time span to create a row group based on the _time field. You can specify time in units of s (second), m (minute), h (hour), d (day), w (week), mon (month), and y (year). For example, 10m is a unit of 10 minutes. If you use a unit of month mon, you can specify only 1mon, 2mon, 3mon, 4mon, and 6mon among the divisors of 12 to enable aggregation. That is, 3mon is allowed, but 5mon is NOT. You need to use 1y instead of 12mon. When the unit is y, only 1y is allowed.
AGGR_FUNC [as ALIAS], ...
Name of a aggregate function (AGGR_FUNC) and optional alias (ALIAS) with the as directive as a field name. If no alias is provided, the command uses the function name as the field name, such as count() and sum(sent_pkts). It is recommended that you specify an ALIAS.
Optional Parameter
by GRP_FIELD, ...
Grouping fields with by directive, separated by a comma(,).

Usage

  1. Count total log occurrences for every 10 minutes.

    timechart span=10m count
    
  2. Show the trend of changes in bytes for every 1 minute.

    timechart span=1m sum(bytes)
    
  3. Count the number of log occurrences for every 1 hour for each destination port.

    timechart span=1h count by dst_port