I have a dhasboard which should show buckets with number of machines by span of time.
Machine A to F is used for 2 mins
Machines D-T was used for 2hrs
Machine s-Z was used for more than 4hrs
So my graph should show the buckets with time range as a standard set.
XAxis
<5 mins,
5-30mins
30min - 2hrs
2-4hrs
> 4hrs
YAxis
No of machines logged on for <2mins
No of machines logged on for 5-30mins
and so on.
| Logon Time | Logoff Time | MachineName | SessionTimeinMins |
| 12/1/2021 19:33 | 12/1/2021 19:36 | A | 3 |
| 12/1/2021 16:46 | 12/1/2021 17:04 | B | 18 |
| 12/1/2021 15:35 | 12/1/2021 15:38 | C | 3 |
| 12/1/2021 11:35 | 12/1/2021 11:38 | D | 120 |
| 12/1/2021 16:35 | 12/1/2021 21:35 | E | 300 |
Base Search | bucket SessionTimeinMins span=20 | chart count(MachineName) by sessionSpan
But this do not help in achieving what i wanted. Any help is much appreciated. Ho do I set my X-Axis to show standard buckets like <2min, 30-1h and bring the count into this bucket.
Thanks
Thank you @ITWhisperer
How can I match the events that fall under this buckets?
like Machine A-X will fall under 5-30min as they all have session times in that timerange.
Thanks for your time and help.
Do you mean something like this?
| stats values(MachineName) as MachineName by sessionSpan
| eval sessionSpan=case(SessionTimeInMins<5,"5 mins",SessionTimeInMins<30,"5-30mins",SessionTimeInMins<120,"30min - 2hrs",SessionTimeInMins<240,"2-4hrs",1==1,"> 4hrs")