Hi All, How do we all the values for a single field? Currently, the chart is displayed with the LoginName(x axis) with the count of LoginName(Y axis). Please see below ScreenShot, What is nee...
See more...
Hi All, How do we all the values for a single field? Currently, the chart is displayed with the LoginName(x axis) with the count of LoginName(Y axis). Please see below ScreenShot, What is needed- Display all the values(Endpoint channel, Destination, FileName,IncidentTime, Count) of the each and every LoginName. Screenshot below, Currently, I am not getting these values and only getting count of LoginName. This is the query that is used, index="prod" sourcetype="*" |rex "sourceServiceName=(?<sourceServiceName>[\w\s]+)\s+\w+=" |rex "duser=(?<duser>[\w\s]+)\s+\w+=" |rex "fname=(?<fname>[\w\s]+)\s+\w+=" |rex "cat=(?<cat>[\w\s]+)\s+\w+=" |rename sourceServiceName as EndpointChannel duser as Destination loginName as LoginName fname as FileName _time as IncidentTime cat as PolicyName |fieldformat IncidentTime = strftime(IncidentTime, "%Y/%m/%d %H:%M:%S") |top showperc=f EndpointChannel Destination FileName PolicyName IncidentTime by LoginName | sort -IncidentTime This query works only in Statistics view and when I click the visualization, I'm not getting the other values. Can someone please help? TIA