perhaps the following answer will help you in your task : Look at this search code which is build with timechart command : source="airports.csv" |timechart sum(number) as sum by City The same code search with xyseries command is : source="airports.csv" |stats sum(number) as sum by _time , City | eval s1="Aaa" | makemv s1 | mvexpand s1 | eval yval=case(s1=="Aaa",sum) | eval series=City |convert timeformat="%a %b %d %Y" ctime(_time) AS c_time | xyseries c_time,series,yval Note that the code : convert timeformat="%a %b %d %Y" ctime(_time) AS c_time is used to change _time command format in the format which is almost like the _time format which appear when we use timechart command. For more information , click on this link to understand well how use timechart vs xyseries http://docs.splunk.com/Documentation/Splunk/6.2.0/Search/Chartmultipledataseries Notice : just replace attentively all my field with your own field . ... View more

Really? Was this necessary? ... View more

Hi Unfortunately neither work. I try to set the source-type based on the directory the file comes from while using a fschange stanza. Setting the sourcetype in inputs.conf does not work as intended but overwrites the sourcetype set by the fschange module (that I need to keep), so setting it in props.conf works fine for me. Besides that I need to treat the files from the listed directories in a special way and ONLY those from those directories. A lot of other files / directories and the like from the same host are fed into splunk but I need not to interfere with their processing. BUT as I wrote above it also applies the rules to a directory like /somedir_/testing2/some_file which it should not do actually so I would like to have the regex stick to the beginning of the source (which is the directory and filename ...) Any ideas ? ... View more

Thanks @araitz, that explains the behaviour. I do remember that "feature" coming up before and wondering whether it was the correct word between my quotes.. Thanks for the help! ... View more

I tried your suggestion, but it won't work 😕 Thanks anyway ... View more

Using access-logs and extracting just the IP address over time, the answer above does not work and provides not results. timechart span=1d sum(count) by SourceIP limit=1000 Just using | timechart by SourceIP does work as expected, outputs the range of IP adresses seen by apache, however, these are not sorted by the most visited IP address. ... View more