Hello Splunk Gurus
I need help with the following. I am sure it is pretty simple command but my head stopped working. i have the following search that brings up the total logon count in 1month span in table format for the last 2 months. How do i create a chart or timechart from this? (total number of logons by each month)
Message="An account was successfully logged on." | bucket _time span=30d | search Message="An account was successfully logged on." AND Source_Port="0"|stats count(Message) AS "Total_Logon_Count" by _time | convert timeformat="%B %d %Y" ctime(_time) | rename _time AS Date |table Date Total_Logon_Count
thanks in advance for all the help!
You should consider reworking your search using the timechart command instead of table and stats:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart?r=searchtip
Once this is done, Returned statistics can be displayed as a visualization via the GUI, you can find information about that here :
https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchTutorial/Chartasareport
You should consider reworking your search using the timechart command instead of table and stats:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart?r=searchtip
Once this is done, Returned statistics can be displayed as a visualization via the GUI, you can find information about that here :
https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchTutorial/Chartasareport
Thanks Jimmy
You are very welcome!