Draw a linechart where the x-axis is time. Time is grouped into buckets.
| Name | Type | Required | Default | Description |
|---|---|---|---|---|
| limit | number | No | Defines the maximum number of series to produce (defaults to 50). A warning is produced if this limit is exceeded, unless the parameter is specified explicitly. | |
| span | string | No | auto | Defines the time span for each bucket. The time span is defined as a relative time modifier like 1hour or “3 weeks”. If not provided or set to ‘auto’ the search time interval, and thus the number of buckets, is determined dynamically |
| buckets | number | No | Defines the number of buckets. The time span is defined by splitting the query time interval into this many buckets. 0..1500 | |
| timezone | string | No | Defines the time zone for bucketing. This value overrides timeZoneOffsetMinutes which may be passed in the HTTP/JSON query API. For example: timezone=UTC or timezone="+02:00” | |
| series | string | No | Each value in the field specified by this parameter becomes a series on the graph | |
| unit | [string] | No | Each value is a unit conversion for the given column. For instance: “bytes/span to Kbytes/day” converts a sum of bytes into Kb/day automatically taking the time span into account. If present, this array must be either length 1 (apply to all series) or have the same length as the function parameter. Default is no conversion. See the reference on this conversion. | |
| function | [Aggregate] | No | count(as=_count) | Specifies which aggregate functions to perform on each group. Default is to count the elements in each group. |
series is the unnamed parameter.
Show the number of different http methods over time. This is done by dividing events into time buckets of 1 minute. Count the http methods (GET, POST, PUT etc). The timechart will have a line for each http method
timechart(span=1min, series=method, function=count())
Show the number of different http methods over time. This is done by dividing events into time buckets of 1 minute. Count the http methods (GET, POST, PUT etc). The timechart will have a line for each http method
timechart(buckets=1000, series=method, function=count())
Graph response time percentiles
timechart(function=percentile(field=responsetime, percentiles=[50, 75, 90, 99, 99.9]))
We use coda hale metrics to print rates of various events once per minute. Such lines include 1-minute average rates “m1=N” where N is some number. This example displays all such meters, converting the rates from events/sec to Ki/day.
type=METER rate_unit=events/second | timechart(name, function=avg(m1), unit="events/sec to Ki/day", span=5m)
Upon completion of every humio request, we issue a log entry which (among other things) prints the size=N of the result. When summing such size’s you would need to be aware of the span, but using a unit conversion, we can display the number in Mbytes/hour, and the graph will be agnostic to the span.
timechart(function=sum(size), unit="bytes/bucket to Mbytes/hour", span=30m)