How to chart multiple fields over time on one graph and create a table summarizing totals by user?

[cpalicensing]

Using the base search listed below it presents me with all print jobs, one print job per user. I would like to chart the fields "Total Pages" by "Full Name" for all users(all results) over time on one graph. In total there are around 37 users and several random "Total Page" counts. Thinking of using a line graph. What would be the best way to complete this?

I then would like to create a table that totals all pages printed by user. So adding the "Total Pages" field, by "Full Name" in a table.

Base Search:

index="win_custom" sourcetype="print-job-accounting-report" 

Thank you!

[renjith_nair · Accepted solution]

Hi @cpalicensing,

Does this work for you ?

Chart

index="win_custom" sourcetype="print-job-accounting-report"|timechart span=1d values("Total Pages") by "Full Name"

If this doesn't fit , please let us know what aggregation you want to do on "Total Pages". Also adjust the span min,day,hour etc

Table

    index="win_custom" sourcetype="print-job-accounting-report"|stats sum("Total Pages") by "Full Name"