Splunk newbie here trying to get a nice line graph showing the session creation pattern over a period of time:
.....|table sessionNum source _time |????????
Not sure what to put there so I get different colored lines one for each source, with NumberOfSessions per source over the time period. Thank you.
if you want to draw a graphic, you cannot use the table command, but you have to use a statistical command like stats, charts or timechart.
so you could use:
your_search |timechart count by sessionNum
to have a time distribution of your events
This will first get the earliest time a particular sessionNum was seen. Then it will chart the count of sessionNums over time by source.
... | stats min(_time) as _time by sessionNum, source | timechart count by source
EDIT: Based on comment below:
... | timechart sum(sessionNum) by source
I guess I am not clear enough. my sessionNUm =Total number of sessions at that particular time on that source. So I can not 'count' again. my 'event' already has the sessionCount. Hope I am making sense. So for a given source , I can have sessionNum 10,11,12,13,12,11,12,13,14,.... etc. And I want to represent it visually
Almost 🙂 In my case I shouldn't sum, I need to take max/min/avg to get the rough number of active sessions per source. thank you.