Hello Splunkers !
i want to write a command that shows a timeline of authentication activities as following:
index=MyIndex eventtype=Authentication user=* action=* src=* | stats count(user) by _time
the output looks like this:
the thing is that the time is in seconds is shown is statistics below:
i want the the command to show count for authentication attempts by minutes not seconds.
Thanks ^_^
index=MyIndex eventtype=Authentication user=* action=* src=*
| bin _time span=1m
| stats count(user) by _time
OR
index=MyIndex eventtype=Authentication user=* action=* src=*
| timechart span=1m count(user)
index=MyIndex eventtype=Authentication user=* action=* src=*
| bin _time span=1m
| stats count(user) by _time
OR
index=MyIndex eventtype=Authentication user=* action=* src=*
| timechart span=1m count(user)
AWESOME !, Thanks ^_^