Writing a Splunk Query - Unique Count of Initial Access Key Usage from Cloudtrail

[tosilesi19]

I have a use case to write a splunk query to display in a line or area chart the unique and initial AWS access key usage by IAM users in our org trending for the past year. Management want to be able to visually show increased cloud adoption numbers over time. Any ideas on how to display this? I feel like I'm almost there with stats but not quite.

index=blah sourcetype=blah user_type=SAMLuser | stats earliest(eventTime) by userIdentity.userName

This almost gets me there, but it won't depict the stats in a pretty line chart.

Thanks!

[to4kawa]

If eventTime is epoch time, how about this?

index=blah sourcetype=blah user_type=SAMLuser 
| stats earliest(eventTime) as _time by userIdentity.userName
| timechart count by userIdentity.userName

[tosilesi19]

this gets me closer! but the userIdentity.userName values are all just flat on the x-axis. I need them to display clearly based on the date they were first used.

[to4kawa]

what's y-axis?
a line or area chart's y-axis is number,you know.