topic How to edit a time chart search to sort on count by date, rather than count by user? in Splunk Search

How to edit a time chart search to sort on count by date, rather than count by user?

bworrellZP — Tue, 20 Oct 2015 11:58:23 GMT

Yesterday I was asked if I can swap out time chart, so that the time is on the top, and user name is on the left.

Background: I have a chart that shows users and count of logins by day. They want to be able to sort on the count by date rather than count by user.

Is there an easy way to change this?

Thanks

wpreston — Tue, 20 Oct 2015 12:19:44 GMT

Try this:

...<your base search here>... | eval Date=strftime(_time, "%D") | chart count by User Date

woodcock — Tue, 20 Oct 2015 13:05:32 GMT

You can also use the transpose command.