create stacked chart showing # alerts over time

[mvasquez21]

My boss has asked me to create a chart that shows the number of fired alerts (y-axis) by day of the month (x-axis). I suggested we do this as a stacked chart with each alert represented by a different color. I know the alert variable is "ss_name" and i found this expression to create the "date":

convert timeformat="%m-%d" ctime(_time) AS date

I just cant get the correct syntax to get all 3 elements in to the chart. So far i have this:

index=_audit action="alert_fired" | convert timeformat="%m-%d" ctime(_time) AS date | timechart date by ss_name

Thanks!

[isoutamo]

Hi

is this enough?

index=_audit action=alert_fired
| timechart span=1d count by ss_name

r. Ismo

[mvasquez21]

This is very good. My problem with Splunk is  always start to overthink things. Timechart is such a powerful command. The only thing i would like to change is the _time format to just show the date as %m/%d

[gcusello]

Hi @mvasquez21,

it'ìs possible but not easy!

Ciao.

Giuseppe