How to edit a time chart search to sort on count by date, rather than count by user?

[bworrellZP]

Yesterday I was asked if I can swap out time chart, so that the time is on the top, and user name is on the left.

Background: I have a chart that shows users and count of logins by day. They want to be able to sort on the count by date rather than count by user.

Is there an easy way to change this?

Thanks

[woodcock]

You can also use the transpose command.

[wpreston · Accepted solution]

Try this:

...<your base search here>... | eval Date=strftime(_time, "%D") | chart count by User Date