adding timespan brings no results

[lancealotx]

I had a simple report showing the past 7 day's (by day) not per hour using the timechart span="86400s" function. The whole string looks like this;

memberLevel="x" AND ApiKey = "123" OR ApiKey = "456" OR ApiKey = "789" OR ApiKey = "123456 | timechart span="86400s" count

That gives a nice chart report by day. Now I want to chart each on the same chart, maybe a stacked one, so wrote this;

*memberLevel="x" AND ApiKey = "123" OR ApiKey = "456" OR ApiKey = "789" OR ApiKey = "123456 | timechart span="86400s" count | stats count BY ApiKey *

Now that 2nd one is what I want as it breaks out the counts by each ApiKey but it's back in an hourly chart. I tried adding the timechart span everywhere but get the error Error in 'stats' command: The argument 'span=86400s' is invalid. so not sure how to make that above chart to be what I want which would be a stacked chart broken by apikey.

I have removed my other 'basic' noob questions since I found the user guide and did the tutorials, and getting the hang, just stuck on this. I'm sure I can find, but if you can also say how to change the legend names as the current says just count.

Thanks.

[farleymike · Accepted solution]

Try...

memberLevel="x" AND ApiKey = "123" OR ApiKey = "456" OR ApiKey = "789" OR ApiKey = "123456 | timechart span=1d count by ApiKey

[lancealotx]

Thanks just got back, put that in and worked.