I've been reading into the splunk documentation, but I'm having trouble formatting a search so that I can use it in a stacked bar graph
Among other data, in this file, some events are logged as such:
%timestamp% - UArateLimit userAgent="%userAgent%" COUNT=%count%
Basically, for each day (there may be multiple logs for each useragent per day, so the final bar graph should have summed counts), I would like to stack the separate useragents and based on their counts.
How can I set up the search so that this is is possible? Thanks!
I think you are looking for something like below, based on your data, with 'count' and 'useragent' being your fields.
<your search> | bucket _time span=1d |stats count(Count) by userAgent
I think you are looking for something like below, based on your data, with 'count' and 'useragent' being your fields.
<your search> | bucket _time span=1d |stats count(Count) by userAgent