topic How to use timechart command for the below query in Splunk Search

How to use timechart command for the below query

divyathota — Fri, 08 Mar 2019 05:49:03 GMT

This is the query i m using:
query1:

sourcetype=tanium earliest=-24h query="User-Sessions-and-Boot-Time-Details-from-Windows" OR query="User-current-session-details-&-Last-Boot-Time---Mac-OSX-to-Splunk" Uptime="1 days" OR Uptime="Less than 1 day" NOT Last_Logged_In_User="*adm"| table Computer_Name Last_Logged_In_User OS_Boot_Time Last_Reboot| eval LastReboot = coalesce(OS_Boot_Time, Last_Reboot)| dedup LastReboot,Last_Logged_In_User| stats count by Computer_Name,Last_Logged_In_User | where count>2

i need a trend analysis for this query for last 30 days.

I also did this:
query2:

sourcetype=tanium query="User-Sessions-and-Boot-Time-Details-from-Windows" OR query="User-current-session-details-&-Last-Boot-Time---Mac-OSX-to-Splunk" NOT Last_Logged_In_User="*adm" | eval LastReboot = coalesce(OS_Boot_Time, Last_Reboot)| dedup LastReboot,Last_Logged_In_User| timechart span=1d count |eval day = strftime(_time,"%d %b %y , %a") |chart sum(count) by day

But, this gives me the entire number of events.
Can anyone help me how to add required condition from query1 to query2

Re: How to use timechart command for the below query

skalliger — Sun, 10 Mar 2019 16:27:07 GMT

If you want a trendline, you might want to use trendline instead of chart. This one does what you want. Look at the examples in the docs.
Also, you might want to use Last_Logged_In_User!="*adm" instead of NOT Last_Logged_In_User="*adm" if you're always expecting a user in your events.

Edit: In your first query, that table command is kind of useless. You can remove it If you're after speeding up the query, replace it with fields and put only the needed events in.

Skalli

Re: How to use timechart command for the below query

niketn — Sun, 10 Mar 2019 17:31:51 GMT

@divyathota, is the following what you are looking for?

sourcetype=tanium earliest=-24h query="User-Sessions-and-Boot-Time-Details-from-Windows" OR query="User-current-session-details-&-Last-Boot-Time---Mac-OSX-to-Splunk" Uptime="1 days" OR Uptime="Less than 1 day" Last_Logged_In_User!="*adm"
| eval LastReboot = coalesce(OS_Boot_Time, Last_Reboot) 
| dedup LastReboot,Last_Logged_In_User
| bin _time span=1d
| stats count by _time, Last_Logged_In_User, Computer_Name
| search count>2
| timechart sum(count) as Total

Re: How to use timechart command for the below query

woodcock — Mon, 11 Mar 2019 03:20:06 GMT

Like this?

index=YouShouldAlwaysSpecifyIndexValues AND ((sourcetype=tanium AND query="User-Sessions-and-Boot-Time-Details-from-Windows") OR (query="User-current-session-details-&-Last-Boot-Time---Mac-OSX-to-Splunk" AND NOT Last_Logged_In_User="*adm"))
| eval LastReboot = coalesce(OS_Boot_Time, Last_Reboot) 
| dedup LastReboot,Last_Logged_In_User 
| bin _time span=1d 
| eventstats count BY Computer_Name,Last_Logged_In_User _time 
| where count>2 
| timechart span=1d count 
| eval day = strftime(_time,"%d %b %y , %a") 
| chart sum(count) by day

NOTE: I may not have done the parentheses correctly but you should NEVER EVER mix AND and OR without parentheses!