Table a query with X and Y

[CMAzurdia]

Good afternoon Splunk Team,

I have my search query: index=example_mine  host=x.x.x.x  [ | inputlookup  myfiile.csv | return 10000 $myfile] logins="successfully logged in" 

Search was last 7 days.

I have received returns of everyone who successfully logged in.

I need to put the results in a nice table format where X=each user and Y=time.

Any help would be appreciated.

v/r

CMAz

[PickleRick]

Ouch. This subsearch with "return 10000" hurts me deeply.

If this is the order of magnitude of the size of your data, be aware that no browser will render such table correctly.

Also, how would you align data in such table where each user has different login time?

[CMAzurdia]

I can change the return, and the time. I just need a syntax to create a table where y=time and X=saml user

[PickleRick]

For putting values in a nice xy-table you can use either chart command or xyseries but...

You have only X and Y. You don't have values which you'd put into the table.

[CMAzurdia]

The events I got back showed results containing:

SAML by user

host

source

sourcetype

the results comes like this: 

Apr 20 10:40:5

3 server AuditLog[123456]: 654321 2025-04-21 10:40:53 UTC 12345678911000@domain sessions|login User 12345678911000@ domain successfully logged in

[ITWhisperer]

Please share some sample anonymised events so we can better advise you.