I had a simple report showing the past 7 day's (by day) not per hour using the timechart span="86400s" function. The whole string looks like this;
memberLevel="x" AND ApiKey = "123" OR ApiKey = "456" OR ApiKey = "789" OR ApiKey = "123456 | timechart span="86400s" count
That gives a nice chart report by day. Now I want to chart each on the same chart, maybe a stacked one, so wrote this;
*memberLevel="x" AND ApiKey = "123" OR ApiKey = "456" OR ApiKey = "789" OR ApiKey = "123456 | timechart span="86400s" count | stats count BY ApiKey *
Now that 2nd one is what I want as it breaks out the counts by each ApiKey but it's back in an hourly chart. I tried adding the timechart span everywhere but get the error Error in 'stats' command: The argument 'span=86400s' is invalid. so not sure how to make that above chart to be what I want which would be a stacked chart broken by apikey.
I have removed my other 'basic' noob questions since I found the user guide and did the tutorials, and getting the hang, just stuck on this. I'm sure I can find, but if you can also say how to change the legend names as the current says just count.
Thanks.
