My boss has asked me to create a chart that shows the number of fired alerts (y-axis) by day of the month (x-axis). I suggested we do this as a stacked chart with each alert represented by a different color. I know the alert variable is "ss_name" and i found this expression to create the "date":
convert timeformat="%m-%d" ctime(_time) AS date
I just cant get the correct syntax to get all 3 elements in to the chart. So far i have this:
index=_audit action="alert_fired" | convert timeformat="%m-%d" ctime(_time) AS date | timechart date by ss_name
Thanks!
Hi
is this enough?
index=_audit action=alert_fired
| timechart span=1d count by ss_name
r. Ismo
This is very good. My problem with Splunk is always start to overthink things. Timechart is such a powerful command. The only thing i would like to change is the _time format to just show the date as %m/%d