timechart
Calculates the result of the aggregate function for every specified time span. If you specify a group field using the by
clause, the field is created as a group field value and the statistics for each field are calculated.
Syntax
timechart span=INT{y|mon|w|d|h|m|s} AGGR_FUNC() [as ALIAS], ... [by GRP_FIELD, ...]
Required Parameter
span=INT{y|mon|w|d|h|m|s}
- Time span to create a row group based on the _time field. You can specify time in units of
s
(second),m
(minute),h
(hour),d
(day),w
(week),mon
(month), andy
(year). For example,10m
is a unit of 10 minutes. If you use a unit of monthmon
, you can specify only1mon
,2mon
,3mon
,4mon
, and6mon
among the divisors of 12 to enable aggregation. That is,3mon
is allowed, but5mon
is NOT. You need to use1y
instead of12mon
. When the unit isy
, only1y
is allowed. AGGR_FUNC [as ALIAS], ...
- Name of a aggregate function (
AGGR_FUNC
) and optional alias (ALIAS
) with theas
directive as a field name. If no alias is provided, the command uses the function name as the field name, such ascount()
andsum(sent_pkts)
. It is recommended that you specify anALIAS
.
Optional Parameter
by GRP_FIELD, ...
- Grouping fields with
by
directive, separated by a comma(,
).
Usage
-
Count total log occurrences for every 10 minutes.
timechart span=10m count
-
Show the trend of changes in bytes for every 1 minute.
timechart span=1m sum(bytes)
-
Count the number of log occurrences for every 1 hour for each destination port.
timechart span=1h count by dst_port