I want to make a linechart of users in a division logged in throughout the day, but I can't make the tstat search work with linechart. The count works fine but I want to group the users by 30 minutes.
A typical users are:
COMPANY\HR94832
COMPANY\AC49328
So I have to filter the user with "COMPANY\HR*.
| tstats summariesonly=true allow_old_summaries=true
dc(Session_SessionDetail.SessionUser) as Users
from datamodel=uberAgent.Session_SessionDetail
where Session_SessionDetail.SessionUser = "COMPANY\HR*" by _time
You just need to add span in your tstats command, like this
| tstats summariesonly=true allow_old_summaries=true
dc(Session_SessionDetail.SessionUser) as Users
from datamodel=uberAgent.Session_SessionDetail
where Session_SessionDetail.SessionUser = "COMPANY\\HR*" by _time span=30m
See this for more information on this option
http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Tstats#BY_clause_arguments
You just need to add span in your tstats command, like this
| tstats summariesonly=true allow_old_summaries=true
dc(Session_SessionDetail.SessionUser) as Users
from datamodel=uberAgent.Session_SessionDetail
where Session_SessionDetail.SessionUser = "COMPANY\\HR*" by _time span=30m
See this for more information on this option
http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Tstats#BY_clause_arguments
Hi @powermundsen,
What about adding |bin span=30m _time|stats sum(count) by _time,sourcetype
to end of your search