Splunk Search

Total Logon Count for Each month

carlyleadmin
Contributor

Hello Splunk Gurus

I need help with the following. I am sure it is pretty simple command but my head stopped working. i have the following search that brings up the total logon count in 1month span in table format for the last 2 months. How do i create a chart or timechart from this? (total number of logons by each month)

Message="An account was successfully logged on." | bucket _time span=30d | search Message="An account was successfully logged on." AND Source_Port="0"|stats count(Message) AS "Total_Logon_Count" by _time | convert timeformat="%B %d %Y" ctime(_time) | rename _time AS Date |table Date Total_Logon_Count

alt text

thanks in advance for all the help!

Tags (1)
0 Karma
1 Solution

jimmytpowers
Path Finder

You should consider reworking your search using the timechart command instead of table and stats:

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart?r=searchtip

Once this is done, Returned statistics can be displayed as a visualization via the GUI, you can find information about that here :

https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchTutorial/Chartasareport

View solution in original post

0 Karma

jimmytpowers
Path Finder

You should consider reworking your search using the timechart command instead of table and stats:

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart?r=searchtip

Once this is done, Returned statistics can be displayed as a visualization via the GUI, you can find information about that here :

https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchTutorial/Chartasareport

0 Karma

carlyleadmin
Contributor

Thanks Jimmy

0 Karma

jimmytpowers
Path Finder

You are very welcome!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...