Timechart

gjhaaland — Fri, 10 Nov 2023 07:33:55 GMT

Hi,

Code is following

index=asa host=1.2.3.4 src_sg_info=*

| timechart span=10m dc(src_sg_info) by src_sg_info

| rename user1 as "David E"

| rename user2 as "Mary E"

| rename user3 as "Lucy E"

If number of user is 0, then we know theres is no VPN user at all. Plan is to print it out together with active VPN user in timechart if possible. Try to explain how it looks below.

user2

user3

No Vpn user No VPN user

time .....................................................................................................................................................................................................................................

Re: Timechart

gcusello — Fri, 10 Nov 2023 07:49:13 GMT

Hi @gjhaaland,

after a timechart command yo have only as columns the count and the values of the src_sg_info field.

user1, user2 atc... are values of src_sg_info field?

if they are values of src_sg_info you have to change the values before the timestamp using eval not rename (rename is to change te name of a field):

index=asa host=1.2.3.4 src_sg_info=* | eval src_sg_info=case(src_sg_info="user1","David E",src_sg_info="user2","Mary E",src_sg_info="user3","Lucy E") | timechart span=10m dc(src_sg_info) by src_sg_info

Ciao.

Giuseppe

topic Timechart in Dashboards & Visualizations

Timechart

Re: Timechart