How to create histogram of a single field?

[parkz]

Hello,

I have a field I created called daysSinceLastSeen that shows the days since an asset was last seen in a scan. I now want to create a histogram to show the distribution of that data by days. How do I do that in spl?

In case you need my search, it is as follows:

| eval elast=strptime(lastSeen,"%Y-%m-%d %H:%M:%S")
| eval daysSinceLastSeen = round((now() - elast)/86400, 1) ```Calculate days elapsed since lastSeen```
| table _time, status, asset_id, scanID, lastSeen, daysSinceLastSeen, last*, firstSeen, ipaddress, source, host
| sort - _time

[ITWhisperer · Accepted solution]

| stats count by daysSinceLastSeen