Hi,
I am doing the following:
index=wineventlog user="*.ad" TaskCategory="Security Group Management" |bucket _time span=10m| timechart count AS EventCount
It is showing a report line for every minute - I would like for it to have a report line for every 10 minutes and I thought that the |bucket _time span=10m would do that.
How can I get this to display results for every 10 minutes?
Thanks in advance
You need to put the span argument directly in the timechart
command. Otherwise, it recalculates a span based on your search period.
New search to try:
index=wineventlog user="*.ad" TaskCategory="Security Group Management" | timechart span=10m count AS EventCount
You need to put the span argument directly in the timechart
command. Otherwise, it recalculates a span based on your search period.
New search to try:
index=wineventlog user="*.ad" TaskCategory="Security Group Management" | timechart span=10m count AS EventCount