My Splunk Timechart isn't returning any values

Question

I'm running a splunk query and trying to generate my first timechart in a few years on a different splunk instance.

I made a query. And I can see that there is data. 2741 events

If I add to the query | stats count Then I see the 2741

But when I try to do a count | timechart per_hour(_cd) as "count" span=1h

I don't get anything back.

Can someone please help?

Answer 1

My query sucks

| timechart span=1h count as requests_per_hour