I'm creating a summary report based on a timechart that counts the number of eventcounts for a certain transaction.
index=xpto | transaction maxspan=2m maxpause=30s fields=correlation | sitimechart count by eventcount
This creates events on my summary index with this structure.
05/02/2013 13:59:00 +0100, search_name="sessions by eventcount - summary", search_now=1367503200.000, info_min_time=1367496000.000, info_max_time=1367499600.000, info_search_time=1367503201.529, 1=0, 2=0, 3=0, 4=7, 7=0, report="sessions"
How can I extract the summary to chart the initial graph?
... View more