Yesterday I was asked if I can swap out time chart, so that the time is on the top, and user name is on the left.
Background: I have a chart that shows users and count of logins by day. They want to be able to sort on the count by date rather than count by user.
Is there an easy way to change this?
Thanks
Try this:
...<your base search here>... | eval Date=strftime(_time, "%D") | chart count by User Date
You can also use the transpose
command.
Try this:
...<your base search here>... | eval Date=strftime(_time, "%D") | chart count by User Date