I tried like this x_webcat_code_full="Uncategorized URLs"
i did get results.
I tried like this x_webcat_code_full="Uncategorized URLs"
i did get results.
Hi pradeep577,
If you want hour as timescale, use the bin option.
... | bin _time span=1h | stats ...
I don't know your exact data structure, but assuming the site field captures which websites were accessed, you can use the search below to how hourly access counts to a specific website, or create a chart access counts by sites on an hourly basis:
souretype="cisco:esa:http" | bin
_time span=1h | stats count(eval(site=yourwebsite)) by
_time
souretype="cisco:esa:http" | bin _time span=1h | chart count over _time by site
Hope this helps. Thanks!
Hunter