How to group same events in timeline until event change and so on?

[nathanluke1986]

Hi I would like to group events in a timeline as a count until a different event occurs

Example:

So basically achieve the following:

A user account was locked out   (count 13)

A process has exited (count 1)

A new process has been created (count 1)

Permissions on an object were changed (count 2)

A process has exited (count 1)

And so on ......

[richgalloway]

Grouping by signature is not the same as a "timeline".  Which is it you want?

To group by signature, use this SPL

... | stats count by signature

[nathanluke1986]

Sorry if this has confused you.

What I want a timeline of the events but grouped if they same signature but only up to the point where the signature value changes in the time line.

so if there are 20 successful logins then a failure then 3 successful I would like it to show:

successful login (count 20)

failure (count 1)

successful (count 3)

|table firsttime signature count.

The issue I am having is there could be pages of successful logins before another event of interest occurs.

I want to tidy up the time line to make it easily readable

[richgalloway]

What visualization do you have in mind?  When I read "timeline" I think of the timechart command, but I'm not sure that's what you're looking for.

... | timechart span=5m count by signature