A chart (of tstat/ counts) of the content that was bookmarked. for the past 7 days

[Amadou]

Hello Can you help me Creating a dashboard that contains the following charts/data:

                     Bookmarked content

1. A chart (of tstat/ counts) of the content that was bookmarked. for the past 7 days
2. A chart with the names of the alerts/detections that were bookmarked for the past 30 days  Analso in this situation how to find your filed name in your splunk: bookmarked, bookmark I use both of them in my query but it still not working or we should use ''active'' please propose me a query.                  help me find the exact field name in order to create the exact query. Thank you. 

[Amadou]

I mean the content i have mapped in my mitre attack in the last 7 days.

[ITWhisperer]

What is bookmarked data? Please share some anonymised, representative sample events showing the event data you are working with, and a representation of your expected results.

[Amadou]

@ITWhisperer

can i created a meeting with you tomorrow?

THANKS

[Amadou]

build a search query that captures the desired data. Assuming that the bookmarked content is logged with an event type or field that specifies when content is bookmarked (e.g., action = "bookmark"),

here's a query you could use:

| tstats count where index="your_index" sourcetype="your_sourcetype" action="bookmark" earliest=-7d@d latest=now by content
| rename content as "Content", count as "Bookmark Count"

but having problem to find the exact field name.