How to modify my timechart to get the results as i needed?

[pavanae]

I have a search as follows in which I am trying to display 2 fields

(My Search) | timechart span=1h count by field_username

which displays the result as follows

_time user_a user_b user_c user_d ----------------------------------

I don't want like this. All I am looking is as follows

_time users_list_of_that_particullar_hour count_of_that_hour

[gcusello · Accepted solution]

Hi pavanae,
to solve your need you have to create a search like this

your_search | bin span=1h _time | stats count values(user) AS users by _time 

Instead if you want to have only one column, for example to use in an Histogram you could merge two fields in one and do you timechart by that new field, something like this:

your_search  | bin span=1h _time | eval Column=user+" - "+strftime(_time,"%Y-%m-%d-%H") | sort Column | stats count by Column

The choice to put before user or _time depends by what you want to emphasize.

Bye.
Giuseppe

[cmerriman]

this should get you the count and distinct list of users by hour

 base search | bin span=1h _time | stats count values(user) as users by _time 

[sundareshr]

Try stats instead

base search | bin span=1h _time | stats count by _time user

[pavanae]

Thank you. Now is there any way I can display the result like listing out all the users for each hour and for each user displaying the list of fields for class_name?..
Sorry If its confusing. I'm trying to display the list of users for each hour and besides that what each user is trying to do for example what he is trying to do information is available in a field called class_name?