Simple Search

[nebel]

Hi there,

maybe its not my day today, struggeling since hours with this case 😉

Per User means one connection. Now I want to count them and bring them into a timechart.

Event:
user
peter
frank
marcus

Every 10 minutes I get a event with the Users. Now I want to count them (3) and display the amount of connections in a timechart.

Thank you very much

Regards

[nebel · Accepted solution]

index=user_db earliest=-24h | multikv fields user | timechart span=10m count AS Connections

[nebel]

I built the following search:

index=user_db | multikv fields user | timechart span=10m count by user

it works, but I don't want to display single user in my graph, only the amount of connections. How can I realize that?