How to chart the 5 most recent events?

merdenoms — Sat, 24 Oct 2020 14:28:32 GMT

How can I chart/graph out the 5 most recent events?

When an event occurs, the data/time is stored in whenCreated. whenCreated has the format of 00:00.00 AM, Weekday DD/MM/YYYY. Can I use this format?

I want to print the eventName and whenCreated. But dedup eventName so that it only shows different values.

Here is my normal query:

index=main admonEventType=* | sort - whenCreated | dedup eventName | table eventName whenCreated | head 5

It looks like I can possibly do this with a statistics table using:

| chart values(*) by eventName

Could I put this in a bar chart?

Re: How to chart the 5 most recent events?

richgalloway — Sat, 24 Oct 2020 18:13:04 GMT

Times in string form will not sort as you might expect so they should be converted into epoch (integer) form before sorting. Try this