https://community.splunk.com/t5/Splunk-Search/Chart-Android-over-Iphone-apache-logs/m-p/165114#M46914 <P>You might be wanting;</P> <P><CODE>... | timechart count by useragent</CODE></P> <P>Possibly you also want to control the size of the time slices used by the timechart, with the use of <CODE>span=&lt;span&gt;</CODE></P> <P>Read more in the docs.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart</A></P> <P>/K</P> Wed, 04 Dec 2013 00:30:45 GMT kristian_kolb 2013-12-04T00:30:45Z https://community.splunk.com/t5/Splunk-Search/Chart-Android-over-Iphone-apache-logs/m-p/165113#M46913 <P>so I have </P> <P>index=apache useragent=<EM>android</EM> | timechart etc etc<BR /> index=apache useragent=<EM>iphone</EM> | timechart etc etc</P> <P>but what I want to do is group by platform. Basically I want a line for iphone, android, mac, windows. How can I limit my user agents to be grouped by platform? </P> <P>index=apache | timechart status by useragent</P> Tue, 03 Dec 2013 23:26:43 GMT https://community.splunk.com/t5/Splunk-Search/Chart-Android-over-Iphone-apache-logs/m-p/165113#M46913 daniel333 2013-12-03T23:26:43Z https://community.splunk.com/t5/Splunk-Search/Chart-Android-over-Iphone-apache-logs/m-p/165114#M46914 <P>You might be wanting;</P> <P><CODE>... | timechart count by useragent</CODE></P> <P>Possibly you also want to control the size of the time slices used by the timechart, with the use of <CODE>span=&lt;span&gt;</CODE></P> <P>Read more in the docs.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart</A></P> <P>/K</P> Wed, 04 Dec 2013 00:30:45 GMT https://community.splunk.com/t5/Splunk-Search/Chart-Android-over-Iphone-apache-logs/m-p/165114#M46914 kristian_kolb 2013-12-04T00:30:45Z