topic Re: Chart count by Duration and User name in Splunk Search

Chart count by Duration and User name

strueblood — Mon, 04 Oct 2010 21:38:24 GMT

I have pulled VPN logs and I'd like to report on the duration that a user has used the VPN tunnel.

I have found the event that shows a disconnected VPN session.

It has the duration information and the user name. I don't know how to create a chart that will include the user name and the duration to next to it.

I have Chart by count Duration (Duration is a field I created)

But I can't seem to put in a search string to show Username and duration next to it.

Re: Chart count by Duration and User name

ftk — Mon, 04 Oct 2010 21:53:14 GMT

You could try doing something like:

your search | chart count Username by Duration

Re: Chart count by Duration and User name

strueblood — Mon, 04 Oct 2010 22:06:28 GMT

That is a very good answer, that answers half my question.

I'm now getting data showing, but I want the duration next to the user name, I'm getting the duration over the top and the count next to the user name.

What would I put instead of count?

Re: Chart count by Duration and User name

ftk — Mon, 04 Oct 2010 22:09:52 GMT

I edited my answer. Have a look.

Re: Chart count by Duration and User name

strueblood — Mon, 04 Oct 2010 22:19:23 GMT

Sorry, I get this error message.

Error in 'chart' command: The specifier 'Duration' is invalid. It must be in form (). For example: max(size).

I get where you are going and I hope it can be that simple, other ideas?

Re: Chart count by Duration and User name

ftk — Mon, 04 Oct 2010 22:33:53 GMT

Hmm, here is another edit. Lemme see if I get this right -- You want a chart (column chart?) that will show a Username and its associated duration? Or do you mean a table?

Re: Chart count by Duration and User name

strueblood — Mon, 04 Oct 2010 22:38:03 GMT

That didn't error out but comes up with zero data. Yes, I to show a bar graph that shows user name and the duration graph next to it.