How do I present my search over time?

[alexgohberg]

Hey

I'm trying to present this search over time, but without success. I tried to use buckets and to add by _time, but it doesn't work. Can you pls assist? Thanks.

The search is:

sourcetype=clientlogs ApplicationIdentifier=AndroidTrader ActionString=#5_Login_User Mode=Real 
| iplocation IPAddress 
| search Country=China
| stats count  as TotalLogins
| appendcols [search sourcetype=clientlogs ApplicationIdentifier=AndroidTrader Mode = Real ActionString="#5_Login_User" StatusDetails = "[justified]" 
| iplocation IPAddress 
| search Country=China
| stats count AS JustifiedErrors
| appendcols [search sourcetype=clientlogs ApplicationIdentifier=AndroidTrader Mode = Real ActionString="#5_Login_User"   StatusID=OK 
| iplocation IPAddress 
| search Country=China 
| stats count AS success ] 
| eval OverallSuccess = JustifiedErrors + success ]
| eval Success_Ratio%=((OverallSuccess/TotalLogins)*100)
| table OverallSuccess TotalLogins Success_Ratio% 

[justinatpnnl]

I think esix was on the right track with having you consolidate your search, you just need to use a timechart to display your results:

sourcetype=clientlogs ApplicationIdentifier=AndroidTrader ActionString=#5_Login_User Mode=Real 
| iplocation IPAddress
| search Country=China
| timechart count as TotalLogins, count(eval(StatusDetails="[justified]")) as JustifiedErrors, count(eval(StatusID="OK")) as success
| eval OverallSuccess = JustifiedErrors + success
| eval Success_Ratio%=((OverallSuccess/TotalLogins)*100)

[esix_splunk]

I believe you can consolidate these down to a more simple search..

sourcetype=clientlogs ApplicationIdentifier=AndroidTrader ActionString=#5_Login_User Mode=Real StatusDetails="*" ActionString="*" StatusID="*"
| iplocation IPAddress 
| search Country=China AND StatusDetails ="[justified]" AND ActionString="#5_Login_User" AND StatusID="OK"
| stats count as TotalLogins count(StatusDetails) as JustifiedErrors count(ActionString) as TotalLogins values(StatusDetails) as success
| eval OverallSuccess = JustifiedErrors + success ]
| eval Success_Ratio%=((OverallSuccess/TotalLogins)*100)
| table OverallSuccess TotalLogins Success_Ratio% 

Since your core search is identical for sourcetype and the additional variables, you can just adjust your stats to match what you need... Appendcols / subsearches arent ideal for larger data sets, and its better to avoid where possible...

[alexgohberg]

Hey Thanks for your answer and its good advice but it is not the info that I looked for.
I will love to Know how I can present it over Time (by _time) without loosing data.

Thanks in advance