Timechart by daily number for 10 or more events

[Madmax]

index=gbts-vconnection sourcetype=VMWareVDM_debug "onEvent: DISCONNECTED" (host=Host1 OR host=host2)
| rex field=_raw "(?ms)^(?:[^:\\n]*:){5}(?P<IONS>[^;]+)(?:[^:\\n]*:){8}(?P<Device>[^;]+)(?:[^;\\n]*;){4}\\w+:(?P<VDI>\\w+)" offset_field=_extracted_fields_bounds
| eventstats count as failed_count by IONS
| where failed_count>=10
| timechart dc(IONS) as IONS span=1d

This command does get me the last 24 hours (11/5/23-11/6/23) stats accurately.  However, when I change the time picker to 30 days it shows a very large number for 11/5,11/6 and every day in that 30 day period.  I need the timechart to show only the IONS that have disconnected 10 or more times and show that number daily in a line chart.  I can't seem to get this to work.  Thank you! 

[ITWhisperer · Accepted solution]

Sounds like IONS has lots of distinct values in the last 30 days - try investigating these

| timechart values(IONS) as IONS span=1d

[Madmax]

Tried it and it shows the _time/date and lists all the IONS (Users) names in the other column.  There is no count of disconnections.  

[ITWhisperer]

You said you were getting high numbers - the change I suggested was just to the last line of your search so instead of counting the distinct values, you listed them, so you could investigate why there were so many.

[Madmax]

Thank you for your help.  Your suggestion did work but I had to add an eval command to make it work:

| eval temp_date = strftime(_time, "%Y-%m-%d")
| eventstats count as failed_count by IONS,temp_date
| where failed_count>=10
| timechart dc(IONS) as IONS span=1d