More on Using Search - Splunk Essentials - page 58

Using the timechart command
We are also interested in figuring out exactly what was sold when. Are there certain days
when we sell more of one product and others when we sell more of another?
To help us answer this question, we can specify the search command as shown in the fol-
lowing screenshot. Here we use the timechart command. This command creates a time
series chart and a table of statistics. Notice that here we have set the timespan to 1 day by
using the span=1d attribute. But we can use other timespans as well for analysis, with a
different granularity.
Enter the following in the search bar:
buttercupgames | timechart span=1d count by productId
After inserting this search, and looking at the Statistics tab, we will be able to see a break-
down of productId sales by date, as shown in the following screenshot:
Time Chart Spanning 1 Day Showing Counts of ProductId