Dashboards & Visualizations

How to create histogram of a single field?

parkz
Explorer

Hello,

I have a field I created called daysSinceLastSeen that shows the days since an asset was last seen in a scan. I now want to create a histogram to show the distribution of that data by days. How do I do that in spl?

 

In case you need my search, it is as follows:

 

| eval elast=strptime(lastSeen,"%Y-%m-%d %H:%M:%S")
| eval daysSinceLastSeen = round((now() - elast)/86400, 1) ```Calculate days elapsed since lastSeen```
| table _time, status, asset_id, scanID, lastSeen, daysSinceLastSeen, last*, firstSeen, ipaddress, source, host
| sort - _time

 

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| stats count by daysSinceLastSeen

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| stats count by daysSinceLastSeen
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...