I am attempting to get the LoginCount of REQUESTING_IP grouping the REQUESTING_IP's together over a 7 day period
index="login_data" sourcetype="Login_Data"[search index="hrxref_data" sourcetype="HR_XREF" John, Doe | table SignonID ] | bucket _time span=1d | stats count as LoginCount by _time REQUESTING_IP
Currently I get
Day1 REQUESTING_IP_1 LoginCount
Day1 REQUESTING_IP_2 LoginCount
Day1 REQUESTING_IP_3 LoginCount
Day2 REQUESTING_IP_1 LoginCount
Day2 REQUESTING_IP_2 LoginCount
Day2 REQUESTING_IP_3 LoginCount
The results I'm trying to get is
Day1 REQUESTING_IP_1 LoginCount
Day2 REQUESTING_IP_1 LoginCount
Day3 REQUESTING_IP_1 LoginCount
Day1 REQUESTING_IP_2 LoginCount
Day2 REQUESTING_IP_2 LoginCount
Day3 REQUESTING_IP_3 LoginCount
Your help would be greatly appreciated
Add "| sort REQUESTING_IP
" at the end.
np. Could you please mark my answer as accepted? Thanks.
That worked like a charm, thanks alot