To begin with, I'm a beginner in world of Splunk. I'm trying to create an area chart where I could track how many users are using the application, how many have completed the application (reached page 6) and how many users are using formManager. In query I've stated that if the user reaches page six, which is the last page of the application, the form is saved to formManager thus adding the user as formManager user. I'm using all three counts successfully as a single value panel in my dashboard but I would like to visualize it in a graph.
dc(user_id) as applicationUsers and count(eval(page_logging=6)) as completedForms works like a charm but dc(eval(page_logging=6)) as formManagerUsers returns only zero or one per hour in my area chart.
I'm using following query as single value to track formManager users:
index=prod sourcetype=application page_logging=6 | stats dc(user_id)
Here's my query for area chart:
index=prod sourcetype=application | timechart span=1h dc(user_id) as applicationUsers, count(eval(page_logging=6)) as completedForms, dc(eval(page_logging=6)) as formManagerUsers
... View more