Creating Time-Based Charts in Splunk: Timechart vs Chart Commands

Quick Answer

Producing a genuinely time-based chart in Splunk comes down to giving a charting command a way to divide the time range into discrete buckets, and there are a couple of syntaxes that accomplish that same underlying goal. chart count by _time span=1d groups events by the _time field with each bucket spanning one day, and as the explanation illustrates with an alternate form, chart over _time bins=24 achieves the equivalent result by instead specifying a fixed number of buckets, 24, for the command to divide the time range into automatically rather than a fixed bucket width. Both approaches end up producing a series of counts per time bucket, which is what makes a chart genuinely time-based rather than just a static breakdown by some other field. The key idea is that chart-style commands need either an explicit span, like span=1d, or an explicit bin count, like bins=24, applied to _time in order to create these buckets; without one of those, a chart command grouping by a non-time field produces categorical results instead. When an exam question asks you to identify commands or syntax that produce a time-based chart, look specifically for _time being used as the grouping field together with either a span or bins parameter defining the bucket size.