How can I chart/graph out the 5 most recent events? When an event occurs, the data/time is stored in whenCreated. whenCreated has the format of 00:00.00 AM, Weekday DD/MM/YYYY. Can I use this format? I want to print the eventName and whenCreated. But dedup eventName so that it only shows different values. Here is my normal query: index=main admonEventType=* | sort - whenCreated | dedup eventName | table eventName whenCreated | head 5 It looks like I can possibly do this with a statistics table using: | chart values(*) by eventName Could I put this in a bar chart?
... View more