So I have the following search and I want to create a dashboard with separate columns for "Hits" and "Misses". Seems this should be pretty straightforward but I am lost joins, stats, evals etc: cf_org_name="ABB" cf_space_name="qa" cf_app_name=*qa-my-app* index=ocf_* "CACHE Hit" OR "CACHE Miss" | timechart span=1d count by type How can I convert this to a chart with 2 columns which show Hits and Misses per day? Thanks ... View more

In my web application, I want to log user country when they first log in. I then want to create a Choropleth using the geom country built in lookup. I understand the examples in how to use the geom tool, but I am not clear on what I need to log into splunk, what to search for and how to get that data correctly into geom. So for example, if I decide to log this every time a user logs in: Log.Info ("User logged in from:" + user.country); e.g.s "User logged in from: Canada" "User logged in from: France" I then want to map the count of each country and map it on a Choropleth. Could someone help me out here? Thanks ... View more

I am trying to determine a way to search for user logins over time to get an idea of application usage. If I have a set number of user ids, I want to get a count of their logins based on a search string in our logs. So my search is like this: "Looking for user based on login/user_id=" "abc123" OR "zxy987" So this would give me all the logs where each of these users had attempted to login and use the application, it could be multiple times per day and there could be multiple entries per day per user of this search string. But I would like to chart this on a dashboard with time on the x-axis and individual 'string search match" count aka login count on the y axis. How would I accomplish this in splunk? Would I need to change my search? ... View more