I am trying to create a timeline dashboard that shows the number of events for a specific user over the last 7 days (x-axis being _time and y-axis being the number of events). We do not have a field option for individual users yet. The syntax I have here will show a nice timeline from Search in Splunk but when I try to create a dashboard line chart for it, I either get nothing or mismatching info. Syntax I use for search: index="myindex1" OSPath="C:\\Users\\Snyder\\*".
@Chase - Did you try the below search?
index="myindex1" OSPath="C:\\Users\\Snyder\\*"
| timechart count
I hope this helps!! Kindly upvote if it does!!!