Hi,
Code is following
index=asa host=1.2.3.4 src_sg_info=*
| timechart span=10m dc(src_sg_info) by src_sg_info
| rename user1 as "David E"
| rename user2 as "Mary E"
| rename user3 as "Lucy E"
If number of user is 0, then we know theres is no VPN user at all. Plan is to print it out together with active VPN user in timechart if possible. Try to explain how it looks below.
user2
user3
No Vpn user No VPN user
time .....................................................................................................................................................................................................................................
Hi @gjhaaland,
after a timechart command yo have only as columns the count and the values of the src_sg_info field.
user1, user2 atc... are values of src_sg_info field?
if they are values of src_sg_info you have to change the values before the timestamp using eval not rename (rename is to change te name of a field):
index=asa host=1.2.3.4 src_sg_info=*
| eval src_sg_info=case(src_sg_info="user1","David E",src_sg_info="user2","Mary E",src_sg_info="user3","Lucy E")
| timechart span=10m dc(src_sg_info) by src_sg_info
Ciao.
Giuseppe