Splunk Enterprise Security

How to create timechart with multiple values?

NDabhi21
Explorer

Hello!
I'm trying to make a timechart day wise action by unique user for the proxy logs like this one below, but I'm unable add action field as column.

Below query i had build . please suggest command to archive this requirement .

_time Action/User  Raj Jane Tom
2023-03-11T00:00:00.000+0000 Permitted 1 1 1
2023-03-11T00:00:00.000+0000 Block 0 2 4


Query was build which generate above result without action column  

| from datamodel:web
| timechart span=1d count(actions) as Actions by user useother=0 limit=10
| addcoltotals

Labels (1)
0 Karma

woodcock
Esteemed Legend

First, accelerate your Web DM, then do this:

| tstats count
FROM datamodel=Web 
BY Web.action Web.user _time span=1d
| rename Web.* AS *
| eval _{action} = count
| fields - action count
| timechart useother=0 limit=10 span=1d sum(_*) AS * BY user
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| bin _time span=1d
| stats count by _time User Action
| eval {User}=count
| fields - count User
| stats values(*) as * by _time Action
0 Karma

NDabhi21
Explorer

Could you please suggest another option, above one is not helpful 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...