https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-create-timechart-with-multiple-values/m-p/639062#M11431 <P>Could you please suggest another option, above one is not helpful&nbsp;</P> Thu, 06 Apr 2023 18:12:20 GMT NDabhi21 2023-04-06T18:12:20Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-create-timechart-with-multiple-values/m-p/634233#M11343 <P><SPAN>Hello!</SPAN><BR /><SPAN>I'm trying to make a timechart day wise action by unique user for the proxy logs like this one below, but I'm&nbsp;unable&nbsp;add action field&nbsp;as column.</SPAN></P> <P><SPAN>Below query&nbsp;i had build . please suggest command to archive this requirement&nbsp;.</SPAN></P> <TABLE width="844"> <TBODY> <TR> <TD width="194">_time</TD> <TD width="194"><STRONG>Action/User&nbsp;</STRONG></TD> <TD width="146">Raj</TD> <TD width="178">Jane</TD> <TD width="132">Tom</TD> </TR> <TR> <TD>2023-03-11T00:00:00.000+0000</TD> <TD><STRONG>Permitted</STRONG></TD> <TD>1</TD> <TD>1</TD> <TD>1</TD> </TR> <TR> <TD>2023-03-11T00:00:00.000+0000</TD> <TD><STRONG>Block</STRONG></TD> <TD>0</TD> <TD>2</TD> <TD>4</TD> </TR> </TBODY> </TABLE> <P><SPAN><BR />Query was build which generate&nbsp;above result without action column&nbsp;&nbsp;</SPAN></P> <P><SPAN>| from datamodel:web<BR />| timechart span=1d count(actions) as Actions by user useother=0 limit=10<BR />| addcoltotals</SPAN></P> Thu, 06 Apr 2023 19:05:14 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-create-timechart-with-multiple-values/m-p/634233#M11343 NDabhi21 2023-04-06T19:05:14Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-create-timechart-with-multiple-values/m-p/634236#M11344 <LI-CODE lang="markup">| bin _time span=1d | stats count by _time User Action | eval {User}=count | fields - count User | stats values(*) as * by _time Action</LI-CODE> Mon, 13 Mar 2023 10:15:06 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-create-timechart-with-multiple-values/m-p/634236#M11344 ITWhisperer 2023-03-13T10:15:06Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-create-timechart-with-multiple-values/m-p/639062#M11431 <P>Could you please suggest another option, above one is not helpful&nbsp;</P> Thu, 06 Apr 2023 18:12:20 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-create-timechart-with-multiple-values/m-p/639062#M11431 NDabhi21 2023-04-06T18:12:20Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-create-timechart-with-multiple-values/m-p/639076#M11432 <P>First, accelerate your Web DM, then do this:</P><LI-CODE lang="markup">| tstats count FROM datamodel=Web BY Web.action Web.user _time span=1d | rename Web.* AS * | eval _{action} = count | fields - action count | timechart useother=0 limit=10 span=1d sum(_*) AS * BY user</LI-CODE> Thu, 06 Apr 2023 19:45:28 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-create-timechart-with-multiple-values/m-p/639076#M11432 woodcock 2023-04-06T19:45:28Z