Splunk Search

Pages with timeline chart

puneetkharband1
Path Finder

index = "abcd" sourcetype = * Customers= ABC |chart count by Pages

I get the pages as a list
I want one of the page occurances with timeline

lets say page name is login.do so I want to know login.do happened at this particular time

0 Karma

somesoni2
SplunkTrust
SplunkTrust

There could be multiple events with one Pages, so which time you want, first time the page was access, last time page was accessed OR all accesses?

For All,

index = "abcd" sourcetype = * Customers= ABC Pages="login.do"  | table Pages _time 

For first and last time it was accessed

index = "abcd" sourcetype = * Customers= ABC Pages="login.do"  | stats min(_time) as FirstTime max(_time) as LastTime by Pages | convert ctime(*Time)
0 Karma

rphillips_splk
Splunk Employee
Splunk Employee
index = "abcd" sourcetype = * Customers= ABC |timechart count by Pages
0 Karma

rphillips_splk
Splunk Employee
Splunk Employee

you're probably looking at the statistics tab.. click on the Visualization tab

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...