https://community.splunk.com/t5/Splunk-Search/How-to-plot-username-non-numeric-value-on-the-y-axis-on-a/m-p/191492#M55135 <P>Hey Venkat,</P> <P>Why not try something like this?</P> <PRE><CODE>... | timechart count(eval(operation="login")) as logins, count(eval(operation="logout")) as logouts by username </CODE></PRE> <P>Then chose a bar/column chart visualization?</P> Mon, 24 Aug 2015 10:24:39 GMT aljohnson_splun 2015-08-24T10:24:39Z https://community.splunk.com/t5/Splunk-Search/How-to-plot-username-non-numeric-value-on-the-y-axis-on-a/m-p/191491#M55134 <P>I have a log in the following format:</P> <PRE><CODE>username=nan time=09:00 operation=login username=ver time=10:00 opertiaon=logout username=ves time=09:00 operation=login username=ves time=10:00 opetaion=logout </CODE></PRE> <P>I need the output in the following format as a scatter plot. I am able to make it in a table, but not in scatter chart.<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/602i5F3F6383965DC723/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Mon, 24 Aug 2015 09:44:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-plot-username-non-numeric-value-on-the-y-axis-on-a/m-p/191491#M55134 Venkat_16 2015-08-24T09:44:29Z https://community.splunk.com/t5/Splunk-Search/How-to-plot-username-non-numeric-value-on-the-y-axis-on-a/m-p/191492#M55135 <P>Hey Venkat,</P> <P>Why not try something like this?</P> <PRE><CODE>... | timechart count(eval(operation="login")) as logins, count(eval(operation="logout")) as logouts by username </CODE></PRE> <P>Then chose a bar/column chart visualization?</P> Mon, 24 Aug 2015 10:24:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-plot-username-non-numeric-value-on-the-y-axis-on-a/m-p/191492#M55135 aljohnson_splun 2015-08-24T10:24:39Z https://community.splunk.com/t5/Splunk-Search/How-to-plot-username-non-numeric-value-on-the-y-axis-on-a/m-p/191493#M55136 <P>Hi aljohnson_splunk,<BR /> Thanks for the response, but we have more than 30+ users and 5 to 6 operations , in that case the following solution gives <BR /> "These results may be truncated. Your search generated too much data for the current visualization configuration." notifaction</P> Mon, 24 Aug 2015 14:14:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-plot-username-non-numeric-value-on-the-y-axis-on-a/m-p/191493#M55136 Venkat_16 2015-08-24T14:14:31Z https://community.splunk.com/t5/Splunk-Search/How-to-plot-username-non-numeric-value-on-the-y-axis-on-a/m-p/191494#M55137 <P>Change the time range and the span, e.g.</P> <PRE><CODE>... earliest=-2w | timechart span=1d count(eval(operation="operation1")) as operation1 .... and so on </CODE></PRE> Mon, 24 Aug 2015 14:18:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-plot-username-non-numeric-value-on-the-y-axis-on-a/m-p/191494#M55137 aljohnson_splun 2015-08-24T14:18:19Z