How to edit my search to find the total count value per month per user?

[galtertime]

I am trying to count the total report runs per month per user.

Example:

"SEARCH STRING" |fields cs_username cs_uri_stem  | eval Month=strftime(_time,"%b") | stats values(Month),count(cs_uri_stem) by cs_username

The results appears in a table like:
USERNAME---Apr -----60---
----------------- Feb -----------
------------------Mar------------

The results are grouped by username, and month, but the count value is total for all months. I need the count value per month. Please assist.

[javiergn]

Try this instead:

"SEARCH STRING" 
| fields _time cs_username cs_uri_stem 
| eval Month=strftime(_time,"%b") 
| stats count(cs_uri_stem) by cs_username, Month

---- Edit to include this other option ---

"SEARCH STRING" 
 | fields _time cs_username cs_uri_stem 
 | eval Month=strftime(_time,"%b") 
 | stats count(cs_uri_stem) as count by cs_username, Month
 | stats list(Month) as Month, list(count) as count by cs_username

[galtertime]

your example produces an output that removes the desired grouping. I want the grouping of months shown in my example above, but the count broken down by month. The example you gave Lists the username and count per month on separate rows.

[javiergn]

Hi, still not clear to me what you are trying to achieve. If you could paste your desired output using the Code Format button (the one above with 1s and 0s) it would be very helpful.

Anyway, try this other approach and let me know if that helps:

"SEARCH STRING" 
| fields _time cs_username cs_uri_stem 
| eval Month=strftime(_time,"%b") 
| stats count(cs_uri_stem) as count by cs_username, Month
| stats list(Month) as Month, list(count) as count by cs_username