Chart Android over Iphone apache logs

[daniel333]

so I have

index=apache useragent=android | timechart etc etc
index=apache useragent=iphone | timechart etc etc

but what I want to do is group by platform. Basically I want a line for iphone, android, mac, windows. How can I limit my user agents to be grouped by platform?

index=apache | timechart status by useragent

[kristian_kolb]

You might be wanting;

... | timechart count by useragent

Possibly you also want to control the size of the time slices used by the timechart, with the use of span=<span>

Read more in the docs.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart

/K