Splunk Search

Total Logon Count for Each month

carlyleadmin
Contributor

Hello Splunk Gurus

I need help with the following. I am sure it is pretty simple command but my head stopped working. i have the following search that brings up the total logon count in 1month span in table format for the last 2 months. How do i create a chart or timechart from this? (total number of logons by each month)

Message="An account was successfully logged on." | bucket _time span=30d | search Message="An account was successfully logged on." AND Source_Port="0"|stats count(Message) AS "Total_Logon_Count" by _time | convert timeformat="%B %d %Y" ctime(_time) | rename _time AS Date |table Date Total_Logon_Count

alt text

thanks in advance for all the help!

Tags (1)
0 Karma
1 Solution

jimmytpowers
Path Finder

You should consider reworking your search using the timechart command instead of table and stats:

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart?r=searchtip

Once this is done, Returned statistics can be displayed as a visualization via the GUI, you can find information about that here :

https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchTutorial/Chartasareport

View solution in original post

0 Karma

jimmytpowers
Path Finder

You should consider reworking your search using the timechart command instead of table and stats:

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart?r=searchtip

Once this is done, Returned statistics can be displayed as a visualization via the GUI, you can find information about that here :

https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchTutorial/Chartasareport

View solution in original post

0 Karma

carlyleadmin
Contributor

Thanks Jimmy

0 Karma

jimmytpowers
Path Finder

You are very welcome!

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!