Splunk Search

Show time reports for a count search

New Member

Dear All,

I'm doing a search with a summarize count at the end. The search is the following:

(eventtype="searchVPN" msg="AUT22675*") OR (eventtype="searchDC" EventIdentifier="680") OR (eventtype="searchVPN" msg="AUT22670*") OR (eventtype="searchDC" EventIdentifier="552") | rename user as User | stats count by User | where count > 10 | stats count

that count the number of user that have generat more that 10 event of the specified event type.

I'd like to obtain a column graphic that, with a column every 5 minutes, shows the value of this search. Example given:

9.00 - 9.05 -> a column height 5 (5 user has generated more that 10 events of those type) 9.05 - 9.10 -> a column height 6 etc etc

How can I do this?

Thank you

Tags (1)
0 Karma
1 Solution

Influencer
(eventtype="searchVPN" msg="AUT22675*") OR (eventtype="searchDC" EventIdentifier="680") OR (eventtype="searchVPN" msg="AUT22670*") OR (eventtype="searchDC" EventIdentifier="552") | rename user as User | bucket _time span=5m | stats count by User,_time | where count > 10 | timechart span=5m count

View solution in original post

0 Karma

Influencer
(eventtype="searchVPN" msg="AUT22675*") OR (eventtype="searchDC" EventIdentifier="680") OR (eventtype="searchVPN" msg="AUT22670*") OR (eventtype="searchDC" EventIdentifier="552") | rename user as User | bucket _time span=5m | stats count by User,_time | where count > 10 | timechart span=5m count

View solution in original post

0 Karma

New Member

thank you very much

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!