Total Logon Count for Each month

[carlyleadmin]

Hello Splunk Gurus

I need help with the following. I am sure it is pretty simple command but my head stopped working. i have the following search that brings up the total logon count in 1month span in table format for the last 2 months. How do i create a chart or timechart from this? (total number of logons by each month)

Message="An account was successfully logged on." | bucket _time span=30d | search Message="An account was successfully logged on." AND Source_Port="0"|stats count(Message) AS "Total_Logon_Count" by _time | convert timeformat="%B %d %Y" ctime(_time) | rename _time AS Date |table Date Total_Logon_Count

thanks in advance for all the help!

[jimmytpowers · Accepted solution]

You should consider reworking your search using the timechart command instead of table and stats:

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart?r=searchtip

Once this is done, Returned statistics can be displayed as a visualization via the GUI, you can find information about that here :

https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchTutorial/Chartasareport

[carlyleadmin]

Thanks Jimmy

[jimmytpowers]

You are very welcome!