https://community.splunk.com/t5/Splunk-Search/Total-Logon-Count-for-Each-month/m-p/382581#M170442 <P>Hello Splunk Gurus</P> <P>I need help with the following. I am sure it is pretty simple command but my head stopped working. i have the following search that brings up the total logon count in 1month span in table format for the last 2 months. How do i create a chart or timechart from this? (total number of logons by each month)</P> <P>Message="An account was successfully logged on.<EM>" | bucket _time span=30d | search Message="An account was successfully logged on.</EM>" AND Source_Port="0"|stats count(Message) AS "Total_Logon_Count" by _time | convert timeformat="%B %d %Y" ctime(_time) | rename _time AS Date |table Date Total_Logon_Count</P> <P><IMG src="https://community.splunk.com/storage/temp/273137-splunk.png" alt="alt text" /></P> <P>thanks in advance for all the help!</P> Wed, 30 Sep 2020 01:16:15 GMT carlyleadmin 2020-09-30T01:16:15Z https://community.splunk.com/t5/Splunk-Search/Total-Logon-Count-for-Each-month/m-p/382581#M170442 <P>Hello Splunk Gurus</P> <P>I need help with the following. I am sure it is pretty simple command but my head stopped working. i have the following search that brings up the total logon count in 1month span in table format for the last 2 months. How do i create a chart or timechart from this? (total number of logons by each month)</P> <P>Message="An account was successfully logged on.<EM>" | bucket _time span=30d | search Message="An account was successfully logged on.</EM>" AND Source_Port="0"|stats count(Message) AS "Total_Logon_Count" by _time | convert timeformat="%B %d %Y" ctime(_time) | rename _time AS Date |table Date Total_Logon_Count</P> <P><IMG src="https://community.splunk.com/storage/temp/273137-splunk.png" alt="alt text" /></P> <P>thanks in advance for all the help!</P> Wed, 30 Sep 2020 01:16:15 GMT https://community.splunk.com/t5/Splunk-Search/Total-Logon-Count-for-Each-month/m-p/382581#M170442 carlyleadmin 2020-09-30T01:16:15Z https://community.splunk.com/t5/Splunk-Search/Total-Logon-Count-for-Each-month/m-p/382582#M170443 <P>You should consider reworking your search using the timechart command instead of table and stats: </P> <P><A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart?r=searchtip">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart?r=searchtip</A> </P> <P>Once this is done, Returned statistics can be displayed as a visualization via the GUI, you can find information about that here : </P> <P><A href="https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchTutorial/Chartasareport">https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchTutorial/Chartasareport</A> </P> Tue, 09 Jul 2019 22:56:25 GMT https://community.splunk.com/t5/Splunk-Search/Total-Logon-Count-for-Each-month/m-p/382582#M170443 jimmytpowers 2019-07-09T22:56:25Z https://community.splunk.com/t5/Splunk-Search/Total-Logon-Count-for-Each-month/m-p/382583#M170444 <P>Thanks Jimmy</P> Wed, 10 Jul 2019 16:34:29 GMT https://community.splunk.com/t5/Splunk-Search/Total-Logon-Count-for-Each-month/m-p/382583#M170444 carlyleadmin 2019-07-10T16:34:29Z https://community.splunk.com/t5/Splunk-Search/Total-Logon-Count-for-Each-month/m-p/382584#M170445 <P>You are very welcome! </P> Thu, 11 Jul 2019 00:16:26 GMT https://community.splunk.com/t5/Splunk-Search/Total-Logon-Count-for-Each-month/m-p/382584#M170445 jimmytpowers 2019-07-11T00:16:26Z