Hi I would like to display my result in this manner
|User Account | Time/Occurences | Count |
| A | 2018/5/5 | |
| | 2018/4/4 | |
| | 2018/3/3 | 3 |
| B | 2018/1/1 | |
| | 2018/2/2 | 2 |
Sorry the | represent columns, space are removed so the result does not look like an excel table which i intend to make
User Account and time occurences field already extracted
Please help provide syntax to display results as such
Given that search: XXXXXXX
What's your current search?
Hi @afez89
Am not sure, if i understood your question correctly
But give this a try
index=yourindexname | stats count by UserAccount Time/Occurences
or can also try -- | chart count by UserAccount over Time/Occurences
Thanks
Hi @powerPacked, It stats no Result found for the first and second one u proposed
if your UserAccount & Time/Occurences fields are extracted, it should work.
& feild names should not contain spaces, in the above question there is space in field
User Account, check with it.
Thanks