Draw a linechart where the x-axis is time. Time is grouped into buckets.

ParameterTypeRequiredDefaultDescription
bucketsnumberfalse Defines the number of buckets. The time span is defined by splitting the query time interval into this many buckets. 0..1500
function[Aggregate]false Specifies which aggregate functions to perform on each group. Default is to count the elements in each group.
limitnumberfalse10Defines the maximum number of series to produce. A warning is produced if this limit is exceeded, unless the parameter is specified explicitly.
  Maximum50 
minSpanstringfalse Defines the time span for each bucket. The time span is defined as a relative-time-synxtax such as 1hour or 3 weeks. If not provided or set to auto, the search time interval —and thus the number of buckets— is determined dynamically.
seriesstringfalse Each value in the field specified by this parameter becomes a series on the graph. [a]
spanstringfalseautoDefines the time span for each bucket. The time span is defined as a relative-time-synxtax like 1hour or 3 weeks. If not provided or set to auto, the search time interval —and thus the number of buckets— is determined dynamically.
timezonestringfalse Defines the time zone for bucketing. This value overrides timeZoneOffsetMinutes which may be passed in the HTTP/JSON query API. For example: timezone=UTC or timezone='+02:00'.
unitstringfalse Each value is a unit conversion for the given column. For instance: bytes/span to Kbytes/day converts a sum of bytes into Kb/day automatically taking the time span into account. If present, this array must be either length 1 (apply to all series) or have the same length as the function parameter. Default is no conversion. See the reference at Relative Time Syntax.

[a] When you provide only one parameter, the implied parameter is series

Examples

Show the number of different http methods over time. This is done by dividing events into time buckets of 1 minute. Count the http methods (GET, POST, PUT etc). The timechart will have a line for each http method

humio
timechart(span=1min, series=method, function=count())

Show the number of different http methods over time. This is done by dividing events into 1000 buckets. Count the http methods (GET, POST, PUT etc). The timechart will have a line for each http method

humio
timechart(buckets=1000, series=method, function=count())

Graph response time percentiles

humio
timechart(function=percentile(field=responsetime, percentiles=[50, 75, 90, 99, 99.9]))

We use coda hale metrics to print rates of various events once per minute. Such lines include 1-minute average rates m1=N where N is some number. This example displays all such meters (which are identified by the field name), converting the rates from events/sec to Ki/day.

humio
type=METER rate_unit=events/second | timechart(name, function=avg(m1), unit="events/sec to Ki/day", span=5m)

Upon completion of every humio request, we issue a log entry which (among other things) prints the size=N of the result. When summing such size's you would need to be aware of the span, but using a unit conversion, we can display the number in Mbytes/hour, and the graph will be agnostic to the span.

humio
timechart(function=sum(size), unit="bytes/bucket to Mbytes/hour", span=30m)