Draw a linechart where the x-axis is time. Time is grouped into buckets.
|number||false||Defines the number of buckets. The time span is defined by splitting the query time interval into this many buckets. 0..1500|
|[Aggregate]||false||Specifies which aggregate functions to perform on each group. Default is to count the elements in each group.|
|number||false||10||Defines the maximum number of series to produce (defaults to 10). Max is 50. A warning is produced if this limit is exceeded, unless the parameter is specified explicitly.|
|string||false||Defines the time span for each bucket. The time span is defined as a relative-time-synxtax such as '1hour' or '3 weeks'. If not provided or set to 'auto' the search time interval, and thus the number of buckets, is determined dynamically.|
|string||false||Each value in the field specified by this parameter becomes a series on the graph.|
|string||false||auto||Defines the time span for each bucket. The time span is defined as a relative-time-synxtax like |
|string||false||Defines the time zone for bucketing. This value overrides |
|string||false||Each value is a unit conversion for the given column. For instance: |
Show the number of different http methods over time. This is done by dividing events into time buckets of 1 minute. Count the http methods (GET, POST, PUT etc). The timechart will have a line for each http method
timechart(span=1min, series=method, function=count())
Show the number of different http methods over time. This is done by dividing events into 1000 buckets. Count the http methods (GET, POST, PUT etc). The timechart will have a line for each http method
timechart(buckets=1000, series=method, function=count())
Graph response time percentiles
timechart(function=percentile(field=responsetime, percentiles=[50, 75, 90, 99, 99.9]))
We use coda hale metrics to print rates of various events once per
minute. Such lines include 1-minute average rates
m1=N where N is some number. This example displays
all such meters, converting the rates from events/sec to Ki/day.
type=METER rate_unit=events/second | timechart(name, function=avg(m1), unit="events/sec to Ki/day", span=5m)
Upon completion of every humio request, we issue a log entry which (among other things) prints the size=N of the result. When summing such size's you would need to be aware of the span, but using a unit conversion, we can display the number in Mbytes/hour, and the graph will be agnostic to the span.
timechart(function=sum(size), unit="bytes/bucket to Mbytes/hour", span=30m)