Splunk Search

How to edit a time chart search to sort on count by date, rather than count by user?

Communicator

Yesterday I was asked if I can swap out time chart, so that the time is on the top, and user name is on the left.

Background: I have a chart that shows users and count of logins by day. They want to be able to sort on the count by date rather than count by user.

Is there an easy way to change this?

Thanks

0 Karma
1 Solution

Motivator

Try this:

...<your base search here>... | eval Date=strftime(_time, "%D") | chart count by User Date

View solution in original post

Esteemed Legend

You can also use the transpose command.

0 Karma

Motivator

Try this:

...<your base search here>... | eval Date=strftime(_time, "%D") | chart count by User Date

View solution in original post