Timechart

[gjhaaland]

Hi,

Code is following

index=asa host=1.2.3.4 src_sg_info=*

| timechart span=10m dc(src_sg_info) by src_sg_info

| rename user1 as "David E"

| rename user2 as "Mary E"

| rename user3 as "Lucy E"

If number of user is 0, then we know theres is no VPN user at all. Plan is to print it out together with active VPN user in timechart if possible. Try to explain how it looks below. 

                                                                                                         user2

                                                                                                          user3

               No Vpn user                                                                                                    No VPN user

time .....................................................................................................................................................................................................................................

[gcusello]

Hi @gjhaaland,

after a timechart command yo have only as columns the count and the values of the src_sg_info field.

user1, user2 atc... are values of src_sg_info field?

if they are values of  src_sg_info you have to change the values before the timestamp using eval not rename (rename is to change te name of a field):

index=asa host=1.2.3.4 src_sg_info=*
| eval src_sg_info=case(src_sg_info="user1","David E",src_sg_info="user2","Mary E",src_sg_info="user3","Lucy E")
| timechart span=10m dc(src_sg_info) by src_sg_info

Ciao.

Giuseppe