I have search that runs every day that populates a CSV that looks like this (I have more sources, but wanted to keep it more simple to explain):
Source | Total | Server | Workstation | Other | Unknown | date |
norton | 735 | 178 | 542 | 5 | 10 | 1612548722 |
nessus | 857 | 8 | 829 | 9 | 11 | 1612548722 |
I would like a time graph to show each source over time, is this possible? I've tried a few methods, but can't seem to manipulate the data to get it to work right. I know the data will have to be converted using SPL like this |fieldformat date = strftime(date, "%m/%d/%Y").
Any ideas how how to make a time graph by source over time?
Thanks!
I think you already have everything you need. There's no need to convert the date field because it's already in epoch form. You do need to assign date to _time, however. Try this query.
| inputlookup mycsv.csv
| eval _time = date
| timechart max(Total) as Total by Source
I think you already have everything you need. There's no need to convert the date field because it's already in epoch form. You do need to assign date to _time, however. Try this query.
| inputlookup mycsv.csv
| eval _time = date
| timechart max(Total) as Total by Source
Works! Thanks!