Splunk Search

How to use timechart to display failed user login info, sorted by time/date of each login attempt?


I'm trying to display failed user login information by using a timechart but I'm not sure how to show the time and date of the logins for each of the user

This is my code :

source="General-linux-sql.log" AND sourcetype="Linux" AND "Failure Audit" AND "Logon "
| rex "User Name\: (?<User_Name>[^\s]+)"
| timechart count by User_Name

This is the output that I get. Also, how do I change it so that all the users are separated?


Labels (2)
0 Karma


How do I display the time for each of the logins as well?

0 Karma



you can do the following to see users

  • change area chart to line chart (OR) column chart
  • If you choose line chart, Format -> General -> Multi series mode -> yes

you can play with both chart type & format options to improve look and feel.

Hope this helps



Thanks for the solution! However, now I have another problem with the Y-axis title. The title is now unreadable even though I changed it. Do you have any fix for this?



0 Karma


Have you tried trellis as visualization? It should work if you have less than 20 user and if more then you must divide those to  group of 20.

r. Ismo

0 Karma

0 Karma