Dashboards & Visualizations

How to modify my timechart to get the results as i needed?

pavanae
Builder

I have a search as follows in which I am trying to display 2 fields

(My Search) | timechart span=1h count by field_username

which displays the result as follows

_time user_a user_b user_c user_d ----------------------------------

I don't want like this. All I am looking is as follows

_time users_list_of_that_particullar_hour count_of_that_hour

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi pavanae,
to solve your need you have to create a search like this

your_search | bin span=1h _time | stats count values(user) AS users by _time 

Instead if you want to have only one column, for example to use in an Histogram you could merge two fields in one and do you timechart by that new field, something like this:

your_search  | bin span=1h _time | eval Column=user+" - "+strftime(_time,"%Y-%m-%d-%H") | sort Column | stats count by Column

The choice to put before user or _time depends by what you want to emphasize.

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi pavanae,
to solve your need you have to create a search like this

your_search | bin span=1h _time | stats count values(user) AS users by _time 

Instead if you want to have only one column, for example to use in an Histogram you could merge two fields in one and do you timechart by that new field, something like this:

your_search  | bin span=1h _time | eval Column=user+" - "+strftime(_time,"%Y-%m-%d-%H") | sort Column | stats count by Column

The choice to put before user or _time depends by what you want to emphasize.

Bye.
Giuseppe

0 Karma

cmerriman
Super Champion

this should get you the count and distinct list of users by hour

 base search | bin span=1h _time | stats count values(user) as users by _time 
0 Karma

sundareshr
Legend

Try stats instead

base search | bin span=1h _time | stats count by _time user
0 Karma

pavanae
Builder

Thank you. Now is there any way I can display the result like listing out all the users for each hour and for each user displaying the list of fields for class_name?..
Sorry If its confusing. I'm trying to display the list of users for each hour and besides that what each user is trying to do for example what he is trying to do information is available in a field called class_name?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...