Hello,
I have a field I created called daysSinceLastSeen that shows the days since an asset was last seen in a scan. I now want to create a histogram to show the distribution of that data by days. How do I do that in spl?
In case you need my search, it is as follows:
| eval elast=strptime(lastSeen,"%Y-%m-%d %H:%M:%S")
| eval daysSinceLastSeen = round((now() - elast)/86400, 1) ```Calculate days elapsed since lastSeen```
| table _time, status, asset_id, scanID, lastSeen, daysSinceLastSeen, last*, firstSeen, ipaddress, source, host
| sort - _time
| stats count by daysSinceLastSeen