Timechart or stats or lastTime

[asarolkar]

When I execute this search, I get all events from organization : Barclays that contains records for 2012.

index="log" | search orgName="org\\barclays" | search "*2012*"

However, i want to do two things:

i) graph the number of calls made into a report
ii) find the timestamp for the last event.

I want to be able to do both without using report builder.

Any pointers on how to proceed with this ?

[asarolkar]

Guys: i want to simply chart the events over time without using the Report builder. Any ideas on how to go about it ?

[Ayn · Accepted solution]

First of all, you don't need to split that up into multiple searches. Rather you'll get worse performance if you do that compared to if use one single search instead.

index="log" orgName="org\\barclays" "*2012*"

Regarding your questions, you need to clarify i) a bit more. How do you count the number of calls? Is that the same as the number of events? Also how do you want to graph it? Over time, split by host, ...

ii)

index="log" orgName="org\\barclays" "*2012*" | stats first(_time)

UPDATE: As for i):

index="log" orgName="org\\barclays" "*2012*" | timechart count by orgName

[Ayn]

Updated my answer.

[asarolkar]

The number of calls IS the same as number of events.

I want to graph is by time and then orgName